Re: [Iptablelog-users] problem with iptables log analizer

[gege <ge...@ge...>]

Hi !

Ummm... That's look stange... for me I have :

Dec 20 08:37:41 nuage kernel: [IPTABLES DROP] : IN=3Dppp0 OUT=3D MAC=3D
SRC=3D212.98.0.45 DST=3D193.251.81.7 LEN=3D60 TOS=3D0x00 PREC=3D0x00 TTL=3D=
51
ID=3D35699 DF PROTO=3DTCP SPT=3D48861 DPT=3D4662 WINDOW=3D5840 RES=3D0x00 S=
YN URGP=3D0
OPT (020405840402080A0106F4240000000001030300)=20

for me it works well... obviously it is exactly the same format...
I thing that there is something strange that happen during data parsing
in perl (locale dependant)... and installation dependant

I will investigate
I will keep you informed

Thanks !
Gege

On Fri, 2002-12-20 at 01:59, Tec. Rogelio Sevilla Fernandez wrote:
> ------------------------------------- (en correo)
>=20
> El archivo email-body fue revisado y no se encontr=F3 algun virus.
> -------------------------------------------------
> ----
>=20

>=20
>=20
> Here's an example of the syslog output:
> Dec 19 18:51:54 telematica kernel: [IPTABLES DROP] : IN=3Deth1 OUT=3Deth1
> SRC=3D80.35.182.92 DST=3D10.10.8.2 LEN=3D48 TOS=3D0x00 PREC=3D0x00 TTL=3D=
106 ID=3D9454
> DF PROTO=3DTCP SPT=3D4662 DPT=3D3128 WINDOW=3D17520 RES=3D0x00 ACK SYN UR=
GP=3D0 OPT
> (020405B401010402)
> Dec 19 18:51:48 telematica kernel: [IPTABLES DROP] : IN=3Deth1 OUT=3Deth1
> SRC=3D80.35.182.92 DST=3D10.10.8.2 LEN=3D40 TOS=3D0x00 PREC=3D0x00 TTL=3D=
106 ID=3D9308
> DF PROTO=3DTCP SPT=3D4662 DPT=3D3128 WINDOW=3D17520 RES=3D0x00 ACK URGP=
=3D0
>=20
>=20
> Any another type of information different of iptables on syslog can damag=
e
> the information on the analyzer? (such any cron job:)
> Dec 19 18:55:00 telematica CROND[30898]: (root) CMD (/usr/bin/sarg)
>=20
> (or some like that?)
>=20
> Thanks..
>=20
>=20
>=20
>=20
> On 20 Dec 2002, gege wrote:
>=20
> > Hi!
> >
> > can you send me a line of your syslog to try to understand why the date
> > are not correctly parsed ?
> >
> > Thanks in advance
> > G=E9g=E9
> >