Re: [fwAnalog] pass rules are listed as blocked?

From: Balázs Bárány (balazs~AT~tud.at)
Date: Thu Jun 26 2003 - 10:20:47 CEST

Next message: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Previous message: Billy Newsom: "[fwAnalog] pass rules are listed as blocked?"
In reply to: Billy Newsom: "[fwAnalog] pass rules are listed as blocked?"
Next in thread: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Reply: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hello,

Billy Newsom <billy~AT~nlcc.us> [2003-06-26 01:40]:
> Are things that are being passed (and logged) included in the analog
It is possible for some kinds of firewalls that don't log this information.

Are you using the freebsd parser? In that case, you could change the zegrep string " -> .+ PR.+len" to " b .+ -> .+ PR.+len" in fwanalog.sh in the freebsd() function.

That would only list the blocked packets. If you want a report of passed packets separately, you would need to modify fwanalog.sh and create a separate output directory.

Regards

-- 
_________________________________________________________________________
Balázs Bárány       balazs~AT~tud.at        http://tud.at       ICQ 10747763

A good engineer will make considerable effort to avoid additional effort.

Next message: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Previous message: Billy Newsom: "[fwAnalog] pass rules are listed as blocked?"
In reply to: Billy Newsom: "[fwAnalog] pass rules are listed as blocked?"
Next in thread: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Reply: Billy Newsom: "Re: [fwAnalog] pass rules are listed as blocked?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.5 : Thu Jun 26 2003 - 20:02:03 CEST