From mboxrd@z Thu Jan 1 00:00:00 1970 From: "curby ." Subject: Re: prerouting logging Date: Wed, 27 Jul 2005 10:58:37 -0600 Message-ID: <5d2f379105072709582a10c978@mail.gmail.com> References: <42E79B51.1080206@eccotours.dyndns.org> Reply-To: "curby ." Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <42E79B51.1080206@eccotours.dyndns.org> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1" To: Brent Clark Cc: iptables On 7/27/05, Brent Clark wrote: > I got tips for nmap blocking from someone on this list. I think I'm that someone. This looks like my post in the "Defeating NMAP Null scans (and Nessus scans)" thread. > Im trying to log the problems that logged. > Would anyone care to recheck my rulset, just to make to I got this right. You might consider more informative prefixes than just "PREROUTING: ". It's fine if some automated parser is going through and will determine scan type by the options logged, but a human reading the log might be helped by an indicator like "PREROUTING NULLscan: " or something of the sort. > P.s. If anyone knows of any other rules I can add, it would be > greatfully be appreciated. My original post did include a NULL scan rule, but not the ACK scan that J=F6rg mentioned.