NAME
iplogger: icmplogd, tcplogd - logging to incoming tcp and icmp sessions
SYNOPSIS
icmplogd [ -d ] [ -f ]
tcplogd [ -f ]
DESCRIPTION
icmplogd is an ICMP session logger. It logs the ICMP packets received by your host.
tcplogd is a TCP session logger. It logs every TCP connection to your host. It detects (at least, it tries to) detect "FTP server bounce" attacks.
OPTION
- -d
-
do not log ICMP destination unreachable packets. (only supported by icmplogd).
- -f
-
logs the results into a file (/var/log/iplogger.log) instead of using the syslog facility.
DEBIAN INIT CONFIGURATION
When runlevel is changed, /etc/init.d/iplogger is executed. This scripts starts the daemons, with the options specified in /etc/iplogger.conf. The options are:
- start-icmplogger
-
Start the ICMP session logger.
- start-tcplogger
-
Start the TCP session logger.
- log-in-file
-
Use the -f options for the daemon: no output will appear on console via syslog; all the messages are logged in /var/log/iplogger.log.
- no-icmp-unreachable
-
Do not log ICMP destination unreachable packets (-d option of icmplogd).
- enable-ident-checking
-
Check the identity of a user making a TCP connection (-i option of tcplogd).
- do-fork
-
Runs an instance of tcplogd for each TCP connection logged (-m option of tcplogd). CAUTION! This option can cause a denial of service.
FILES
/etc/iplogger.conf - Debian configuration file
/var/log/iplogger.log - log file (if option -f is used)
SEE ALSO
/usr/doc/iplogger/README - note of the author
/usr/doc/iplogger/ftpbounce.txt - description of the "FTP server bounce attack"
AUTHORS
Mike Edulla ([email protected]) Shawn Michael ([email protected])
MANUAL AUTHOR
Hugo Haas ([email protected])