Re: Strange Packet logs in ipchains

From: Bear Giles <bgiles(at)coyotesong.com>
Date: Wed Mar 26 2003 - 15:30:16 EST

Sam Dirk wrote:
> The packets

Use snort, or something similiar to it, and set it up on a box without ipchains filtering. Set up rules that are essentially the complement of your firewall rules, and you'll catch all traffic that the firewalls are rejecting. There's then no need to run tcpdump explicity (or hit yourself in the head when you realize that tcpdump is running behind the packet filtering so it would never record anything).

You can even take this to an extreme - set it up on your firewall(s) and log ALL traffic trying to enter or leave your network. Let another process prune out the expected traffic, then examine what's left....

Bear

---

SurfControl E-mail Filter puts the brakes on spam, viruses and malicious code. Safeguard your business critical communications. Download a free 30-day trial: http://www.surfcontrol.com/go/zsfsbl1 Received on Thu Mar 27 10:03:03 2003