Recommendations on fluffy pretty stuff...

qubex

Hello! Thanks for reading this far.

For the last year I have been using Firestarter as my "gui of choice" for hacking out a firewall.sh script. This has been working superbly - no problems, no hackers, no open holes. I know it's not perfect, but the ability to see what is going on at any given moment is invaluable to me.

I am looking to upgrade/change software. I want something with a more "proactive approach" - something like watchguard's windows client - something that will interact with both IPTABLES and netstat and maybe even a packet sniffer and give me a realtime view of who is connected to what on my network, and who is hitting what port and whether it is open/closed/etc.

Is this possible? Does software exist like this yet?

Thanks!
matt

uzik · Apprentice Joined: 17 Apr 2003 Posts: 257

You might look up these words in your search engine

tarpit
honeypot
ethereal sniffer

There used to be a module for freesco that monitored for port scans
and banned the scanner for a time. You could whip this up in shell
script if you were inclined to

qubex · Posted: Wed Jun 11, 2003 4:41 pm Post subject:

Thanks for the recommendations.. Not quite what I was looking for. A combination of ethereal and firestarter I guess is what I am looking for. Ethereal by itself provides too much information, most of it unnecessary (for my needs) - firestarter provides good information on firewall hits, but what happens if a "nice" connection is made to an open port 80? This does not get displayed, rejected, or logged (other than through httpd logging facilities) Perhaps nothing like this exists in linux? Perhaps I have found my first project?

This is for my home. Let's say I'm at work and the boss says "weirdness is happening in dodge kimosabe, check for intruders" - what utility would I use, at a glance, to see who is currently connected to a machine? Who is currently being denied access to a machine? Netstat would do this *I think* - is there a gui for it? (I'm not oldskool, i can use CLI but prefer GUI)

(In other words, something that will show every connection, and/or attempted connection, through a particular machine or interface. It *should* be realtime but I can live with it..)

The honeypot is a great idea, when I have a little more money for an "extra box"!

Thanks!

uzik · Apprentice Joined: 17 Apr 2003 Posts: 257

qubex · Posted: Thu Jun 12, 2003 3:23 pm Post subject:

herbie · Guru Joined: 09 Oct 2002 Posts: 319 Location: London UK

you may also want to have a look at iptraf, it's a curses based realtime ip trafic monitor. I don't think that it'll show you what packets are getting rejected but it will definitly list all the current connections and tell you to which ports and from where.

Herbie

qubex · Posted: Thu Jun 12, 2003 4:56 pm Post subject:

Excellent! This was the other half of the puzzle I was looking for. Thanks for the suggestion!

This will save a ton of time! Keep these suggestions coming! Any more programs like this??

uzik · Apprentice Joined: 17 Apr 2003 Posts: 257

DrkPlague · Tux's lil' helper Joined: 04 Jun 2003 Posts: 107

snort is always a popular option. with the proper rule sets it can do almost anything.
_________________
DKP

There are 10 kinds of people in the world:
Those who understand binary and those who don't...