iplogger8

Usage

Overview

icmplogd is an ICMP session logger. It logs the ICMP packets received by your host.

tcplogd is a TCP session logger. It logs every TCP connection to your host. It detects (at least, it tries to) detect "FTP server bounce" attacks.

Option

-d

do not log ICMP destination unreachable packets. (only supported by icmplogd).

-f

logs the results into a file (/var/log/iplogger.log) instead of using the syslog facility.

Debian init configuration

When runlevel is changed, /etc/init.d/iplogger is executed. This scripts starts the daemons, with the options specified in /etc/iplogger.conf. The options are:

start-icmplogger

Start the ICMP session logger.

start-tcplogger

Start the TCP session logger.

log-in-file

Use the -f options for the daemon: no output will appear on console via syslog; all the messages are logged in /var/log/iplogger.log.

no-icmp-unreachable

Do not log ICMP destination unreachable packets (-d option of icmplogd).

enable-ident-checking

Check the identity of a user making a TCP connection (-i option of tcplogd).

do-fork

Runs an instance of tcplogd for each TCP connection logged (-m option of tcplogd). CAUTION! This option can cause a denial of service.

Files

/etc/iplogger.conf - Debian configuration file

/var/log/iplogger.log - log file (if option -f is used)

Manual author

Hugo Haas ([email protected])