Reading and analyzing the log broadcast of a WRT54G [SOLVED]

Jkay · Last edited by Jkay on Sun Apr 16, 2006 5:32 am; edited 1 time in total

Hi, Is there a Linux app like "WallWatcher" for Windows, which will listen on the log broadcast port of a Linksys router/fw and record/analyze these logs? I did a forum search and haven't come across any info on this yet.

tia~~
JK

think4urs11 · Posted: Sat Apr 15, 2006 9:44 pm Post subject:

mhh from what i can tell Wallwatcher seems to be a combination of syslog+snmptrap

So e.g. syslog-ng and snmptrapd should be enough to listen for the logs of your Linksys.
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

Jkay · Posted: Sun Apr 16, 2006 12:47 am Post subject:

Ah hah! Using your suggestions as keywords in a Google search, I found this:

http://www.gentoo-wiki.com/HOWTO_Use_MRTG_with_a_Linksys_Router

Thanks!

Jkay · Posted: Sun Apr 16, 2006 4:35 am Post subject:

DOUBLE AH-HAH!

Syslog-ng has built-in syslogd capabilty! The default(ish) log program for Gentoo can read remote TCP and UDP log broadcasts.

I added a UDP port 514 source line in my syslog-ng config, and piped it to the /var/log/ area and viola ... it works.

I added these lines:

Jkay · Posted: Sun Apr 16, 2006 7:52 pm Post subject:

As a final note, I'm using fwlogwatch to analyze the Linksys logs, as an hourly cron job, and generate an HTML summary file which I have bookmarked in my browser.

Example:
http://members.cox.net/jkay/firewall_report.html

Of course I filter out outbound traffic to port 80, or that log would be huge.