Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: TCP SYN probe detection tool available
From: jwa () nbs nau edu (James W. Abendschan)
Date: Wed, 15 May 1996 18:01:56 -0700


Way back on May 15,  3:25am, Brian Mitchell wrote:
This is a good idea. I have also written a similar tool, although mine
logs all syn packets. It uses the libpcap interface. Should compile under
linux, freebsd, irix, sunos, solaris, etc. It is available at
http://www.saturn.net/~brian/files/clog-001.tar.gz (libpcap is not
included with the distribution).

Well, while we're on the subject..

I've written a perl script to do a similar task-- mine logs all SYN
packets (although you can exclude data destined for a particular port;
I exclude port 80 and 113 as they generate so much traffic) as well
as logging portscans.

It requires tcpdump and a little bit of hacking to get it to work
on your particular subnet, but it doesn't chew alot of CPU time --
unless, of course, someone is doing a portscan :-)

You can find it at http://www.nbs.nau.edu/~jwa/Security/synsniff.tar.gz
Comments/suggestions about how to improve it are welcome.

James


--
James W. Abendschan                                 Email: jwa () nbs nau edu
UNIX Systems Programmer/Administrator               Phone: (520) 556-7466 x238
Colorado Plateau Research Station, Flagstaff, AZ    Voice mail: *516



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]