Sponsored Content
Special Forums IP Networking All incoming connections ips LOG Post 302964173 by bakunin on Monday 11th of January 2016 05:30:54 PM
Old 01-11-2016
Quote:
Originally Posted by [xEF]Danger
How to make a log that will log all ips that connect to the server or send packets?
While this is perhaps possible (look into tcpdump if you insist) you don't want to do that. Usually a server has one or at best several services it offers - like "web services" if it is a web server, etc.. This makes one or several ports (for the exemplary webserver this is 80 - HTTP) necessary. Identify these, close all the others and log only those really necessary. Most network-applications (web server software, for instance) offer specialized logging facilities for what they do. You should use these.

Quote:
Originally Posted by [xEF]Danger
And how to block an ip that make packets flood and try to DDoS? Thanks.
Not at all. Of course, there are IP-filtering programs like "iptables", but a "server" should do what it is intended to do - nothing else. For everything else there are specialized machines (firewalls, packet filters, etc.) which you should task with filtering the IP packets for things not to be processed. Put such a system "in front of" the server and route all traffic through it, dropping what should not be processed.

I hope this helps.

bakunin
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Listening on port for incoming data?

I am not what I would call an experienced programmer. I know some ksh etc.. I need to be able to listening on a port for incoming data on a ultra 10 using solaris 9. Basically all that I need to do at the moment is to log the incoming data on a specific port number. Any ideas on how I... (6 Replies)
Discussion started by: frustrated1
6 Replies

2. Programming

rlogin/rsh incoming port

Hi all, In need to know why my sample code below that connect to a rlogind (513) fails, but original unix rlogin does not ? (.rhosts is verified to be correct) I heard rlogin/rsh bind to a reserved port before connecting to the rlogin server. what are they ??? s = socket(AF_INET,... (1 Reply)
Discussion started by: andryk
1 Replies

3. AIX

loggin incoming ftp connections in syslog

Hello, we recently configured syslog on one of our machines with the following line in /etc/syslog.conf *.info /audit/syslog.log rotate time 1d compress However it does not seem to be logging incoming ftp connections, only outgoing ftp connections? Is there a way to log incoming ftp... (2 Replies)
Discussion started by: zuessh
2 Replies

4. UNIX for Dummies Questions & Answers

run a script from incoming email

hi I have a bit of a problem i need help with. I have a script that runs no problems when i run it manually. as soon as i stick in tester: /app/scripts/run.pl into /etc/aliases & try to run it by sending a mail it doesnt work. the output files are owned by daemon, which i dont like & think... (7 Replies)
Discussion started by: jojo77
7 Replies

5. IP Networking

handling incoming messages

I have a few clients connecting to the server(which is using select()) and theyre trying to send messages to each other. How do I wait for input on stdin and at the same time I wait for data to being sent from the server? Should I use select() in my client too? How exactly though? (1 Reply)
Discussion started by: charlitos
1 Replies

6. Shell Programming and Scripting

Incoming mail Alert !!

Hi, If I am getting any new mail in my mail box I need an alet message . Please help me to get the script .. (1 Reply)
Discussion started by: pranabrana
1 Replies

7. Solaris

logging incoming connections on solaris 10

i've been able to log incoming telnet and ssh connections on solaris 9 using the following lines in /etc/syslog.conf # Telnet connections are logged to auth.notice auth.notice /var/adm/authlog # An entry in /etc/profile logs all telnet connections... (2 Replies)
Discussion started by: soliberus
2 Replies

8. Linux

incoming mails not coming

I am using Linux box. i am able to send mails through sendmail to local and other domains. i am not receving any incoming mails. dovecot service is running. (4 Replies)
Discussion started by: harishindn
4 Replies

9. Shell Programming and Scripting

Block all incoming connection for 10h

Hi all, I am working on a shell script that blocks all incoming and outgoing connections for 10 hours. After then hours everything will be unblocked again. i am using the ipfw command and put it to sleep the amount of time in seconds. ipfw -q flush ipfw -f add deny tcp from any to... (8 Replies)
Discussion started by: runtimeError
8 Replies

10. Shell Programming and Scripting

Log of lost internet connections

I am having a big problem with lost internet connections with my DSL. I would like to create a log to be able to show the technician when he comes next week. I would like for it to only log pings that generate 100% packet loss. Thanks.. This script generates all ping attempts including... (4 Replies)
Discussion started by: drew77
4 Replies
DOVEADM-WHO(1)							      Dovecot							    DOVEADM-WHO(1)

NAME
doveadm-who - Show who is logged in to the Dovecot server SYNOPSIS
doveadm [-Dv] [-f formatter] who [-1] [-a anvil_socket_path] [user] [ip[/mask]] DESCRIPTION
The who command is used to show which users from which hosts are currently connected to which service. OPTIONS
Global doveadm(1) options: -D Enables verbosity and debug messages. -f formatter Specifies the formatter for formatting the output. Supported formatters are: flow prints each line with key=value pairs. pager prints each key: value pair on its own line and separates records with form feed character (^L). tab prints a table header followed by tab separated value lines. table prints a table header followed by adjusted value lines. -v Enables verbosity, including progress counter. This command uses by default the output formatter table. Command specific options: -1 Print one line per user and connection. Otherwise the connections are grouped by the username. -a anvil_socket_path This option is used to specify an alternative socket. The option's argument is either an absolute path to a local UNIX domain socket, or a hostname and port (hostname:port), in order to connect a remote host via a TCP socket. By default doveadm(1) will use the socket /var/run/dovecot/anvil. The socket may be located in another directory, when the default base_dir setting was overridden in /etc/dovecot/dovecot.conf. ARGUMENTS
ip[/mask] Specify an ip address or network range, in CIDR notation, to reduce the result to matching connections. user List only users, whose name match user. It's also possible to use wildcards in the user name. EXAMPLE
Show authenticated sessions, filtered by the client's IP address. doveadm who ::1 username # proto (pids) (ips) jane 2 imap (30155 30412) (::1) doveadm who 192.0.2.0/24 username # proto (pids) (ips) john@example.com 1 imap (30257) (192.0.2.34) Show authenticated sessions, filtered by username. doveadm who pvo username # proto (pids) (ips) pvo 1 sieve (30343) (fd95:4eed:38ba::25) pvo 4 imap (25693 25686 25679 25669) (fd95:4eed:38ba::25) doveadm who ja* username # proto (pids) (ips) james 1 imap (30091) (127.0.0.1) jane 2 imap (30155 30412) (::1) REPORTING BUGS
Report bugs, including doveconf -n output, to the Dovecot Mailing List <dovecot@dovecot.org>. Information about reporting bugs is avail- able at: http://dovecot.org/bugreport.html SEE ALSO
doveadm(1), doveadm-kick(1) Dovecot v2.1 2010-07-12 DOVEADM-WHO(1)
All times are GMT -4. The time now is 01:39 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy