Perl and netstat

shotgunefx has asked for the wisdom of the Perl Monks concerning the following question:

Recently I had a problem with some naughty folk trying to DoS me. My first thought was to make a monitor for connections using netstat. I of course reached for CPAN and to my suprise, there was no equivilant. I thought for sure someone would make a wrapper. I decided to roll my own and posted the snippets I used.

My question is... is this something worth making into a coherent structure and posting it to CPAN? Is there an equivilant that I missed?

Thanks,

-Lee

"To be civilized is to deny one's nature."

Comment on Perl and netstat

Replies are listed 'Best First'.
Re: Perl and netstat by panix (Monk) on Jul 24, 2002 at 09:35 UTC
I'm not aware of any - but you might find Net::Pcap (and NetPacket::*) more useful for analyzing traffic - it'll give you access to every packet coming in over a given interface. For your netstat wrapper - presumably for tracking a dos you're going to want the results continuously? I'd consider parsing /proc/net/tcp,/proc/net/udp,etc instead of constant netstat execs.	[reply]
Re: Re: Perl and netstat by shotgunefx (Parson) on Jul 24, 2002 at 09:43 UTC
Actually, what I was trying to detect was a bunch of SYN_REC's coming from one location. I check every five minutes and alarm if it happens. I'm going to modify it to automatically add them to ipchains to filter them out. -Lee "To be civilized is to deny one's nature."	[reply]