comment on

I've been using this for some time, and having a wee bit o'spare time lately, decided it might possibly maybe perhaps be of use to fellow monks. So without further ado, I offer for your consideration a perl one-liner that can help you to know when your box is being probed by sckiddies and crackers.

ippl is a *nix packet logger. By configuring it to log suspicous packets in a longer format than mundane packets, and by resolving their source address, you can trivially extract info on nefarious goings-on. The example log below illustrates my web server being probed for nonexistant FTP, DNS, and WINS services.

* relevent chunk from ippl.conf:

noresolve all
logformat normal all
log options resolve,detaild tcp port ftp
log options resolve,detaild tcp port domain        # zone xfer
log options resolve,detaild udp port netbios-ns
etc...
[download]

* sample lines from ippl.log:

Nov  2 20:14:19 www connection attempt from 199.8.65.44
Nov  2 22:03:34 last message repeated 47 time(s)
Nov  2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.co
+m [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov  3 18:03:09 domain connection attempt from cha213245016252.chello.
+fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)
Nov  4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dia
+lin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)
[download]

* sample munged output:

Nov  2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.co
+m [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov  3 18:03:09 domain connection attempt from cha213245016252.chello.
+fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)

Nov  4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dia
+lin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)
[download]

* from a perlish perspective, it matches any line containing an open-paren *unless* the paren is immediately preceeded by the word "time". perldoc perlre says that's a zero-width positive lookahead assertion.

Update: Hmmm... props to blakem for cleaner and more recognizable syntax below. I vaguely recall seeing that in perlre, but must've already had this'un working.

perl -ne 'print if (/\(/ && $` !~ /time$/)' < ippl.log > ippl.noteworthy

In reply to (code) One-liner parses ippl log for suspicious packets by ybiC

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


Perl Monk, Perl Meditation
	PerlMonks