Re: [Firestarter-user] no "hits"

[Jack B. <jb...@sh...>]

** Reply to message from Tyler Longren <ty...@ca...> on Wed, 17 Jul 2002 22:18:56 -0500


> Anybody have any ideas?
> 
> tyler
> 
> On Tue, 16 Jul 2002 23:08:07 -0500
> Tyler Longren <ty...@ca...> wrote:
> 
> > Hi,
> > 
> > I use firestarter for NAT and port forwarding (I forward http packets
> > to a machine in the internal network).
> > 
> > I've run many online port scans on my machine, and nothing is ever
> > displayed in the "Firewall hits" tab.  This is the case for me in
> > 0.8.2 and in 0.8.3rc3.
> > 
> > Does anyone know what might cause this?  I've already read the F.A.Q.
> > on the website about this.  It just suggests that I may be using the
> > wrong log file and that syslogd might not be running.
> > 
> > thanks,
> > tyler


Hey, Tyler. Sorry for the delayed response but I just got back from holidays :-))

When anybody mentions scanning their machine on this list, we always have to ask whether the scan was done from the same box that FS is running on or if it was from an external box. The only way to properly scan your own box is from the outside - that is, on the *other* side of your firewall. You will get all kinds of bogus hits if you scan from inside the firewall. 

Having said that,  one way to see if something is amiss is to do the following in a terminal window (as root) while you are doing the scan:

tail -f /var/log/messages

Then when you do the scan, you should see the hits streaming by in the terminal window. If you get hits in the terminal but not in the FS GUI, then there is a problem that the developers should look at.

jb

-- 
Jack Bowling
mailto: jb...@sh...