How to monitoring activity on a card?

[Patrick Proniewski]

On 03 mars 2004, at 10:51, Francisco Reyes wrote:

> My setup 4.9 stable with IPFW. Machine acts as gateway for two 
> machines.
>
> What are my options on monitoring activity on my external card?
>
> This morning I noticed my DSL modem activity light is blinking 
> non-stop.
> Looking at /var/log/ don't see anything suspicious.
>
> I feel tempted to add "log" to all my ipfw pass rules, but wonder if 
> there
> isn't a better way.
>
> I am mostly concerned there is either some kind of attack going on or
> somehow the machine was hacked and it's running something it's not
> supposed to.


If you really want some real-time control, you might want to try 
tcpdump, But you'll soon be flooded by the data.
Best practice it probabely to put some log rules to your IPFW and then 
use a log parser to get some stats from your that.
You can also add an IDS of some sort, and checkrootkit on a crontab.

patpro
-- 
je cherche un poste d'admin-sys Mac/UNIX
(ou une jeune et jolie femme riche)
http://patpro.net/cv.php