Time stamp for Recent

Time stamp for Recent

[Kevin Appel]

Hello everyone,

I am using the recent module to set up a rule to block too many ssh attempts and I am curious about the last_seen number.  Is this some sort of timestamp and if it is, is it possible to translate this to a readable format?

Example:
[root@caddy net]# cat /proc/net/ipt_recent/sshscans
src=192.168.1.21 ttl: 64 last_seen: 6908449 oldest_pkt: 5 last_pkts: 6866823, 6867384, 6867634, 6908149, 6908449

Thank you,

Kevin

Re: Time stamp for Recent

[Jörg Harmuth]

Kevin Appel schrieb:
> Hello everyone,
> 
> I am using the recent module to set up a rule to block too many ssh attempts and I am curious about the last_seen number.  Is this some sort of timestamp and if it is, is it possible to translate this to a readable format?
> 
> Example:
> [root@caddy net]# cat /proc/net/ipt_recent/sshscans 
> src=192.168.1.21 ttl: 64 last_seen: 6908449 oldest_pkt: 5 last_pkts: 6866823, 6867384, 6867634, 6908149, 6908449
> 
> Thank you,
> 
> Kevin

I don't know the answer, but looks like sequence numbers to me. But this
may bo totally wrong.

For what you want to do, this thread may be of interest for you,
especially Grant's ideas:

https://lists.netfilter.org/pipermail/netfilter/2005-May/060299.html

Have a nice time,

Joerg

Re: Time stamp for Recent

[Grant Taylor]

>I don't know the answer, but looks like sequence numbers to me. But this
>may bo totally wrong.
>
>For what you want to do, this thread may be of interest for you,
>especially Grant's ideas:
>
>https://lists.netfilter.org/pipermail/netfilter/2005-May/060299.html
>  
>
You may want to take a look at the newer version of this script.  It has grown a LOT.  You can find the thread in the mail list archives here:  https://lists.netfilter.org/pipermail/netfilter/2005-June/061362.html