Looking for Log Analyzer

Looking for Log Analyzer

[Susan Sagan]

[-- Attachment #1: Type: text/plain, Size: 462 bytes --]

Before writing my own, I was wondering if there were tools available for
analyzing the output log file from iptables.  I was in particular looking
for tools which created a variety of different reports.  One such example
being a report listing the top traffic generators. 


Susan Sagan
Unix Systems Administrator
Ottawa Data Center, Unix Services
CGI Information Systems and Management
Phone: 613-740-5900 ext 5351
Fax: 613-749-2201
Email: susan.sagan@cgi.com


[-- Attachment #2: winmail.dat --]
[-- Type: application/ms-tnef, Size: 1716 bytes --]

Re: Looking for Log Analyzer

[Al-Juhani]

Here isnetfilter an online tool at http://logi.cc/linux/NetfilterLogAnalyzer.php3.

For more links about Iptables check this URL: http://www.linuxguruz.org/iptables/


Al-Juhani
aljuhani@zajil.net

----- Original Message ----- 
From: "Susan Sagan" <susan.sagan@cgi.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, January 30, 2003 23:48
Subject: Looking for Log Analyzer


> Before writing my own, I was wondering if there were tools available for
> analyzing the output log file from iptables.  I was in particular looking
> for tools which created a variety of different reports.  One such example
> being a report listing the top traffic generators. 
> 
> 
> Susan Sagan
> Unix Systems Administrator
> Ottawa Data Center, Unix Services
> CGI Information Systems and Management
> Phone: 613-740-5900 ext 5351
> Fax: 613-749-2201
> Email: susan.sagan@cgi.com

RE: Looking for Log Analyzer

[Khanh Tran]

I found http://iptablelog.sourceforge.net/.  I haven't gotten around to
installing it yet, but it looks ok from the screenshots.  It requires mySQL,
PHP and PERL with access to mySQL, so it's not a quick out-of-the-tar.gz
solution.

Khanh Tran
Network Operations
Sarah Lawrence College


-----Original Message-----
From: Al-Juhani [mailto:aljuhani@zajil.net]
Sent: Sunday, February 02, 2003 3:27 PM
To: netfilter@lists.netfilter.org
Cc: susan.sagan@cgi.com
Subject: Re: Looking for Log Analyzer


Here isnetfilter an online tool at
http://logi.cc/linux/NetfilterLogAnalyzer.php3.

For more links about Iptables check this URL:
http://www.linuxguruz.org/iptables/


Al-Juhani
aljuhani@zajil.net

----- Original Message ----- 
From: "Susan Sagan" <susan.sagan@cgi.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, January 30, 2003 23:48
Subject: Looking for Log Analyzer


> Before writing my own, I was wondering if there were tools available for
> analyzing the output log file from iptables.  I was in particular looking
> for tools which created a variety of different reports.  One such example
> being a report listing the top traffic generators. 
> 
> 
> Susan Sagan
> Unix Systems Administrator
> Ottawa Data Center, Unix Services
> CGI Information Systems and Management
> Phone: 613-740-5900 ext 5351
> Fax: 613-749-2201
> Email: susan.sagan@cgi.com

Re: Looking for Log Analyzer

[Hervé Eychenne]

On Thu, Jan 30, 2003 at 03:48:47PM -0500, Susan Sagan wrote:

> Before writing my own, I was wondering if there were tools available for
> analyzing the output log file from iptables.  I was in particular looking
> for tools which created a variety of different reports.  One such example
> being a report listing the top traffic generators. 

Try wflogs...
http://www.wallfire.org/wflogs/

 RV

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

IPLIMIT Patch UDP

[Ing. CIP Alejandro Celi Mariategui]

(Sorry, but my english is very bad)

Hi,

I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd Knorr
<kraxel@bytesex.org>

It work fine, i can limit ex: max 10 TCP connections on the server, but
i want to limit the UDP connections to 10 (max).

How I can do it?

Alex

Re: IPLIMIT Patch UDP

[Jan Du Caju]

Hi,

Ing. CIP Alejandro Celi Mariategui wrote:

>(Sorry, but my english is very bad)
>
>Hi,
>
>I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd Knorr
><kraxel@bytesex.org>
>
>It work fine, i can limit ex: max 10 TCP connections on the server, but
>i want to limit the UDP connections to 10 (max).
>
>How I can do it?
>
This week I made a updlimit patch (shameless copy of iplimit ;-)
I will post it this afternoon/evening when I have more time (and
a cross post to the netfilter-devel list. Maybe they like it)

Greetz,
Jan.
------------------------------------- KULeuvenNet ------

Re: IPLIMIT Patch UDP

[Joel Newkirk]

On Thursday 20 February 2003 06:50 pm, "Ing. CIP Alejandro Celi " 
Mariategui wrote:
> (Sorry, but my english is very bad)
>
> Hi,
>
> I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd
> Knorr <kraxel@bytesex.org>
>
> It work fine, i can limit ex: max 10 TCP connections on the server,
> but i want to limit the UDP connections to 10 (max).
>
> How I can do it?
>
> Alex

The IPLIMIT patch is limited to only work with TCP.  You'd likely need to 
write your own changes to the kernel.  At a VERY quick glance, this:

+	/* refuse anything but tcp */
+	if (ip->proto != IPPROTO_TCP)
+		return 0;

in the IPLIMIT patch (in iplimit.c) MIGHT provide the solution if it 
accomodated IPPROTO_UPD as well as, or instead of, IPPROTO_TCP.

j