Re: [AMaViS-user] p0f/p0f-analyzer init.d script?

[Shaun T. E. <ste...@gm...>]

On 1/1/07, Bill Landry <bi...@in...> wrote:
>
> I tried the init script and was unsuccessful at making that work.
> Instead, try adding something like the following to /etc/rc.local:
>
> /usr/sbin/p0f -f /etc/p0f/p0f.fp -l 'tcp dst port 25' 2>&1 |
> /usr/local/sbin/p0f-analyzer.pl 2345 &
>
> Use whatever recipe you currently use, but make sure you use full paths
> to all files.  This will start both p0f & p0f-analyzer upon reboot.

Yes, I start it in a similar fashion as well. What I want though, is
to have it done "properly", in an init.d script of its own, so that I
can start and stop it at will.

If this isn't doable (but I'd be surprised if it wasn't), then another
alternative might be to start p0f via it's own init.d script and
modify p0f-analyzer to read from the p0f log, instead of from STDIN.
Now that I think about it, that seems like a better solution. Then
p0f-analyzer could be stopped and started independently from p0f, with
its own init.d script, and both could be started/stopped cleanly. I'm
sure there was a reason it wasn't done this way though, that I'm
missing ...
-- 
        -ste