log analysis

log analysis

[Gene Dellinger]

A couple of questions:
Anyone have a recommendation on a good log anlaysis tool for
iptables/netfilter?
How difficult is it to perform Intrusion Detection using iptables, any real
world stories(good and bad) desired.

Thanks
Gene D.

Re: log analysis

[Ruprecht Helms]

Gene Dellinger wrote:

> How difficult is it to perform Intrusion Detection using iptables, any real
> world stories(good and bad) desired.

Sorry, but good intrusion detection is very different to iptables. 
Iptables only control the connections based on ports. With connection 
tracking you can check if there is made some portscan or someone tried
to send a ping of death to you.

Modifying in the filesystem can not be controled by iptables. That is
task of a good intrusion detection system.

Regards,
Ruprecht

------------------------------------------------------------------------------------------
Ruprecht Helms IT-Service & Softwareentwicklung

Tel./Fax  +49[0]7621 16 99 16
Web:       htp://www.rheyn.de

RE: log analysis

[Bob]

> Anyone have a recommendation on a good log analysis tool for 
> iptables/netfilter?

For log analysis you can try webfwlog.

http://www.webfwlog.net

-Bob

RE: log analysis

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 399 bytes --]

Le jeudi 27 octobre 2005 à 06:19 -0700, Bob a écrit :
> > Anyone have a recommendation on a good log analysis tool for 
> > iptables/netfilter?
> 
> For log analysis you can try webfwlog.
> 
> http://www.webfwlog.net

Or nulog :
	http://www.inl.fr/Nulog.html

> 
> -Bob
> 

-- 
Éric Leblond, eleblond@inl.fr
Téléphone : 01 44 89 46 40, Fax : 01 44 89 45 01
INL, http://www.inl.fr

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: log analysis

[Derick Anderson]

 
Inline.
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
> Gene Dellinger
> Sent: Wednesday, October 26, 2005 11:14 PM
> To: netfilter@lists.netfilter.org
> Subject: log analysis
> 
> A couple of questions:
> Anyone have a recommendation on a good log anlaysis tool for 
> iptables/netfilter?

Yes. It's called Snort. =)

> How difficult is it to perform Intrusion Detection using 
> iptables, any real world stories(good and bad) desired.

Next to impossible unless you start writing your own string-based
signatures and get the string match or l7 support I keep hearing about.

> Thanks
> Gene D.
> 

I don't log with netfilter. I use Snort and BASE for NIDS. There are
many viable options for NIDS and HIDS (like Tripwire). In my opinion the
only purpose of the LOG/ULOG targets are testing rules on live
firewalls. The default netfilter logs don't include the packet payload
anyway, which can tell you whether the M$ command banner Snort flagged
is real or just Bugtraq.

Derick Anderson