From: ratheesh k <ratheesh.ksz@gmail.com>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: Netfilter mailing list <netfilter@vger.kernel.org>,
ulogd@lists.gnumonks.org
Subject: Re: Advanced Logging
Date: Fri, 4 Jun 2010 07:47:14 +0530 [thread overview]
Message-ID: <AANLkTinkq6e66NTi4PSkAF5fa1do9pj8BlzB18xrJGHz@mail.gmail.com> (raw)
In-Reply-To: <alpine.LSU.2.01.1006032043580.16179@obet.zrqbmnf.qr>
On Fri, Jun 4, 2010 at 12:32 AM, Jan Engelhardt <jengelh@medozas.de> wrote:
>
> On Thursday 2010-06-03 20:15, ratheesh k wrote:
>>2010/5/30 Tomáš Vlček <tomasvlcek@gmail.com>:
>>> Maybe psad (Port Scan Attack Detector) is that what are you looking
>>> for. Check http://cipherdyne.org/psad/index.html.
>>
>>I gone through the link . It seems to be heavy for my embedded application .
>
> Yes it looks complicated from a developer POV. I myself think
> why would it have to put up with analyzing log messages
> (which are known to be not overly precise) when direct delivery
> with libnetfilter_queue/_log seems like a more ideal goal -
> eliminating the extra trip through syslog and the fs.
\
Thanks Jan .
ulogd demon could be modified to do analysis of packet to find out
what of kind of attack has taken place ?
-Ratheesh
next prev parent reply other threads:[~2010-06-04 2:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-30 14:28 Advanced Logging ratheesh k
2010-05-30 16:22 ` Curby
2010-05-30 18:19 ` Tomáš Vlček
2010-06-03 18:15 ` ratheesh k
2010-06-03 19:02 ` Jan Engelhardt
2010-06-04 2:17 ` ratheesh k [this message]
2010-06-03 20:17 ` Mart Frauenlob
2010-06-03 21:16 ` Mart Frauenlob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=AANLkTinkq6e66NTi4PSkAF5fa1do9pj8BlzB18xrJGHz@mail.gmail.com \
--to=ratheesh.ksz@gmail.com \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
--cc=ulogd@lists.gnumonks.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).