4876l1.txt100664 2046 330 1120 7343756471 11160 0ustar jillljedit4876l1 Listing 1. Reading Firewall Messages with kmsgsd open LOG, ">> /var/log/psad/fwdata" or die "$!\n"; while (1) { open FIFO, "< /var/log/psadfifo" or die "$!\n"; $service = ; # don't slow down with chomp if (($service =~ /Packet\slog/ \ || $service =~ /IN.+?OUT.+?MAC/) \ && $service =~ /DROP|REJECT|DENY/) { # log the denied/rejected packet to the fwdata file my $old_fh = select LOG; $| = 1; # take care of buffered output to LOG print "$service"; select $old_fh; } } 4876l2.txt100664 2046 330 1526 7343756471 11173 0ustar jillljedit4876l2 Listing 2. nmap Command and Output with ipchains Output [root@scanner ~]# nmap -sX -p 79-81 myserver Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ ) Interesting ports on myserver (10.10.10.50): (The 2 ports scanned but not shown below are in state: closed) Port State Service 80/TCP open http Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds Aug 5 11:53:12 myserver kernel: Packet log: input ACCEPT eth1 PROTO=6 192.168.0.15:33236 10.10.10.50:80 L=40 S=0x00 I=36707 F=0x0000 T=50 (#2) Aug 5 11:53:12 myserver kernel: Packet log: input ACCEPT eth1 PROTO=6 192.168.0.15:33216 10.10.10.50:79 L=40 S=0x00 I=17607 F=0x0000 T=50 (#2) Aug 5 11:53:12 myserver kernel: Packet log: input ACCEPT eth1 PROTO=6 192.168.0.15:33216 10.10.10.50:81 L=40 S=0x00 I=35017 F=0x0000 T=50 (#2) 4876l3.txt100664 2046 330 1314 7343756471 11167 0ustar jillljedit4876l3 Listing 3. iptables Messages from TCP Session with Web Server Aug 4 12:16:56 myserver kernel: IN=eth1 OUT= MAC=00:a0:cc:e2:1f:f2:00:20:78:1c:60:58:08:00 SRC=192.168.10.10 DST=10.10.10.50 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25415 DF PROTO=TCP SPT=2591 DPT=80 WINDOW=32120 RES=0x00 SYN URGP=0 Aug 4 12:16:56 myserver kernel: IN= OUT=eth1 SRC=10.10.10.50 DST=192.168.10.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=80 DPT=2591 WINDOW=5792 RES=0x00 ACK SYN URGP=0 Aug 4 12:16:56 myserver kernel: IN=eth1 OUT= MAC=00:a0:cc:e2:1f:f2:00:20:78:1c:60:58:08:00 SRC=192.168.10.10 DST=10.10.10.50 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=25416 DF PROTO=TCP SPT=2591 DPT=80 WINDOW=32120 RES=0x00 ACK URGP=0 4876l4.txt100664 2046 330 3654 7343756471 11201 0ustar jillljedit4876l4 Listing 4: Sample psad E-mail Alert: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Aug 2 01:13:03: Portscan Detected by psad (pid 405) on myserver.mydomain.com Source: 192.168.10.10 Destination: 10.10.10.50 Newly scanned TCP ports: [80] (since: Aug 2 01:13:03) Complete port range: [53-80] (since: Aug 2 00:54:53) Total number of packets: 9 Start time: Aug 2 00:54:53 End time: Aug 2 01:13:03 Danger level: 1 out of 5 DNS info: 192.168.10.10 -> attacker.com TCP flags: [SYN: 2 packets] Nmap: [-sT or -sS] TCP flags: [SYN FIN: 2 packets] TCP flags: [URG PSH FIN: 5 packets] Nmap: [-sX] =-=-= TCP alert signatures found since [Aug 2 01:13:03] "NMAP XMAS scan" dp=80, flags=URG PSH FIN. YOUR MACHINE IS LISTENING ON (tcp) PORT: 80/tcp Packets=5 =-=-=-=-=-=-= Whois Information =-=-=-=-=-=-= IANA (IANA-CBLK-RESERVED) Internet Assigned Numbers Authority 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6695 US Netname: IANA-CBLK1 Netblock: 192.168.0.0 - 192.168.255.255 Coordinator: Internet Corporation for Assigned Names and Numbers (IANA-ARIN) +res-ip@iana.org (310) 823-9358 Domain System inverse mapping provided by: BLACKHOLE.ISI.EDU 128.9.64.26 BLACKHOLE.EP.NET 198.32.1.116 These blocks are reserved for special purposes. Please see RFC 1918 for additional information. Record last updated on 16-May-2001. Database last updated on 31-Jul-2001 23:07:46 EDT. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=