I've been using this for some time, and having a wee bit o'spare time lately, decided it might possibly maybe perhaps be of use to fellow monks.   So without further ado, I offer for your consideration a perl one-liner that can help you to know when your box is being probed by sckiddies and crackers.

ippl is a *nix packet logger.   By configuring it to log suspicous packets in a longer format than mundane packets, and by resolving their source address, you can trivially extract info on nefarious goings-on.   The example log below illustrates my web server being probed for nonexistant FTP, DNS, and WINS services.

* relevent chunk from ippl.conf:

noresolve all
logformat normal all
log options resolve,detaild tcp port ftp
log options resolve,detaild tcp port domain        # zone xfer
log options resolve,detaild udp port netbios-ns
etc...

[download]

* sample lines from ippl.log:

Nov  2 20:14:19 www connection attempt from 199.8.65.44
Nov  2 22:03:34 last message repeated 47 time(s)
Nov  2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.co
+m [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov  3 18:03:09 domain connection attempt from cha213245016252.chello.
+fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)
Nov  4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dia
+lin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)

[download]

* sample munged output:

Nov  2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.co
+m [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov  3 18:03:09 domain connection attempt from cha213245016252.chello.
+fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)

Nov  4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dia
+lin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)

[download]

* from a perlish perspective, it matches any line containing an open-paren *unless* the paren is immediately preceeded by the word "time".   perldoc perlre says that's a zero-width positive lookahead assertion.

Update: Hmmm... props to blakem for cleaner and more recognizable syntax below.   I vaguely recall seeing that in perlre, but must've already had this'un working.



perl -ne 'print if (/\(/ && $` !~ /time$/)' < ippl.log > ippl.noteworthy

In reply to (code) One-liner parses ippl log for suspicious packets by ybiC

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.