[Iptablelog-users] Slow Database Updates/Inserts and reverse lookups

[Michael B. <Mic...@In...>]

All,

=20

I made a change the feed_db.pl script. I started noticing after a period
of time (2-3 hours to 1 day) the web page would not report the current
entries in the firewall logs and I thought the perl script hung up or
stop; so I would stop/start the script over and over again. This seemed
to fix it as it would start inserting and showing the current firewall
log entries. After repeatedly doing this, I stopped the script from
running in the background so I could see where it fails. Finds out that
the script never fails, but actually starts to perform poorly due to all
the reverse dns lookups. This part of the perl script and function of
socket:=20

=20

my($iaddr) =3D inet_aton($entry{'DST'});

my($host_name) =3D gethostbyaddr($iaddr, AF_INET);

=20

is what does the reverse lookups for the source and destination ip
addresses. I get a lot of hits on my firewalls and the perl script would
just get further and further behind. 9am this morning, the script was
just now processing yesterdays entries at 2pm... so I made a change to
the script. Since I know the destination IP Addresses I changed the
script so that it would not perform reverse lookups on the destination
IP addresses. This changed made a world of difference, now the perl
script lags only 2-4 minutes behind and sometimes it shows current.=20

=20

I changed this (line 138 - feed_db.pl):

  my($iaddr) =3D inet_aton($entry{'DST'});

  my($host_name) =3D gethostbyaddr($iaddr, AF_INET);

  if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else {
$entry{"DST_NAME"}=3D"unknown"; }

=20

To this:

  #my($iaddr) =3D inet_aton($entry{'DST'});

  #my($host_name) =3D gethostbyaddr($iaddr, AF_INET);

  #if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else {
$entry{"DST_NAME"}=3D"unknown"; }

=20

$entry{"DST_NAME"}=3D"unknown";

=20

It would be better to cache the dns entries and use them later, but this
was quick and dirty for me.

=20

Thanks,

Michael Brown

Corporate Security Analyst

InterCept Corporate Security Services

Phone: 770.840.3918

Fax: 678.418.4797

A-Key: 1007-0101

=20