Re: Remote Syslogd

From: James Lee Bell <nuclear-cowboy(at)cox.net>
Date: Wed Nov 06 2002 - 11:37:39 EST

I remember reading something about this as well. The (unvoiced) question I had then, as now, is what does this rig do to actual network traffic? Specifically, won't something along the way end up generating ICMP-host unreachables at some point for every log packet to the phantom logging host? Thinking this through, you know that the following hardware config isn't going to get packets pushed out the "correct" interface (where the snort box is hiding) without something ARPing for the phantom ip, a default gateway pointing inside (unlikely), or the phantom ip being some internal network that "int dev" is advertising as such.

   |
ext dev

   |
   +-- Snort
   |
int dev

In any of these cases, at some point "int dev" is going to be generating ICMP-"something" unreachables for every single syslog packet. Or am I missing something?

Gino Pietro Guidi wrote:

>I have recently came across an article that described secure logging

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Fri Nov 8 20:59:19 2002