Re: [fwAnalog] full analisys

From: Balázs Bárány (balazs~AT~tud.at)
Date: Sun May 23 2004 - 10:35:12 CEST

• Next message: Stephen Cooper: "[fwAnalog] Multiple PIX Log Sources"
• Previous message: Claudio M. Neiva: "[fwAnalog] full analisys"
• In reply to: Claudio M. Neiva: "[fwAnalog] full analisys"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hi,

• Claudio M. Neiva <NeivaCM~AT~americanembassy.org.br> [2004-05-20 13:23]:
  > Is there a way of get the full analisys of pf log(Blocked and Accepted
  you could hack the egrep line in pf_30() ("rule .+: block .+ on .+ [0-9.]{7}") and the subsequent perl rules but then you couldn't distinguish blocked from accepted packets. I don't see the use of such reports.

> I want to include the Operating system chart...
Does pf log the operating systems of blocked machines? Even if it does, analog has built-in OS strings, so it would be a major hackery to give it the strings in the format it likes. If you have such logs, please send them to me. ("tcpdump -n -e -ttt -q -r /your/pflog" output)

Regards

-- 
_________________________________________________________________________
Balázs Bárány       balazs~AT~tud.at        http://tud.at       ICQ 10747763

A good engineer will make considerable effort to avoid additional effort.

• Next message: Stephen Cooper: "[fwAnalog] Multiple PIX Log Sources"
• Previous message: Claudio M. Neiva: "[fwAnalog] full analisys"
• In reply to: Claudio M. Neiva: "[fwAnalog] full analisys"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.5 : Wed May 26 2004 - 17:22:04 CEST