Re: [Packetfence-devel] Pfdetect problems

[Kevin A. <Kevin@Amorin.org>]

Peter,
    Try
http://sourceforge.net/mailarchive/forum.php?thread_id=10095991&forum_id=43415
and see if it helps.  We have a couple of these fixes in 1.6

Kevin

Peter Bates wrote:
> Hello all...
>
> This is still with 1.5, so I guess with a move to 1.6 this might all go
> away.
>
> I'm still having pfdetect fall over, generally when
> there's something a bit 'busy' on the network protected by PF.
>
> May 26 14:37:25 wisdom pf: pfdetect: alert received:
> 05/26-14:37:25.104114  [**]
>  [117:1:1] (spp_portscan2) Portscan detected from 192.168.1.200: 401
> targets 401
>  ports in 19 seconds [**] {UDP} 192.168.1.200:18470 ->
> 220.161.43.159:14554
> May 26 14:37:25 wisdom pf: normal_sighandler: caught SIGPIPE -
> terminating
> May 26 14:37:25 wisdom pf: END: stopping
>
> ... this was a BitTorrent client or variant.
>
> The main thing is that I thought I should be doing:
>
>  /usr/local/pf/bin/pfcmd control pfdetect start
>
> ... except it always complains something else is running (snort,
> httpd)
> so I tend to just end up doing the equivalent of
> '/etc/init.d/packetfence restart'.
>
> Any ideas?
>
>
> --------------------------------------------------------------------------------------------------->
> Peter Bates, Systems Support Officer, IT Services.
> London School of Hygiene & Tropical Medicine.
> Telephone:0207-958 8353 / Fax: 0207- 636 9838 
>
>
> -------------------------------------------------------
> All the advantages of Linux Managed Hosting--Without the Cost and Risk!
> Fully trained technicians. The highest number of Red Hat certifications in
> the hosting industry. Fanatical Support. Click to learn more
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
> _______________________________________________
> Packetfence-devel mailing list
> Pac...@li...
> https://lists.sourceforge.net/lists/listinfo/packetfence-devel
>