IPFW log results analysis

Uwe Kolsch uwe.kolsch at wax.co.uk
Fri Jun 18 02:44:31 PDT 2004


Is there a tool for FBSD like logwatch on Linux, which can provide a detailed
but still somehow summarized output based on the logging results of IPFW. I mean
more detailed than this from the daily security run:

> 02010    557     48486 deny log ip from any to any out
> 10000   1026     49716 deny ip from any to any in setup
> 10003   3859    828227 deny ip from any to any in

... and more like this.

###
Logged packets on interface eth0:

   From 4.10.38.220 (4.10.38.220).
      To 212.146.89.141 (212.146.89.141).
         Service: 2745 (tcp/2745)
            (,eth0,none) - 3 packet(s)
      Total of 3 packet(s).
   Total of 3 packet(s).

   From 4.10.95.247 (4.10.95.247).
      To 212.146.89.140 (212.146.89.140).
         Service: swat (tcp/901)
            (,eth0,none) - 1 packet(s)
      Total of 1 packet(s).
      To 212.146.89.141 (212.146.89.141).
         Service: swat (tcp/901)
            (,eth0,none) - 1 packet(s)
      Total of 1 packet(s).
   Total of 2 packet(s).
###

Thanks

Uwe Kolsch



More information about the freebsd-questions mailing list