mon / Patches / #8 new monitor: worm/network scan detector for ipchains gateway

#8 new monitor: worm/network scan detector for ipchains gateway

Status: open

Owner: nobody

Labels: None

Priority: 5

Updated: 2003-10-17

Created: 2003-10-17

Creator: Matthew Astley

Private: No

General purpose monitor, periodically runs "ipchains -M
-L -n" to find out which machines are masquerading
through the gateway. Sources that seem to be hitting a
lot of different destinations all at once are flagged.

Monitor successfully notified us of a W32.Nachia
infection this morning.

Release under GPL from Granta Design approved by Paddy
Clark.

Discussion

Matthew Astley - 2003-10-17

Logged In: YES
user_id=144698

(odd, the patch file upload didn't work... try again)

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Matthew Astley - 2003-10-17

anti-netscan monitor

mon_masq_netscan.monitor

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

new monitor: worm/network scan detector for ipchains gateway

Group

Searches

Help

#8 new monitor: worm/network scan detector for ipchains gateway

Discussion