snippet
ybiC
I've been using this for some time, and having a wee bit o'spare time lately, decided it might possibly maybe perhaps be of use to fellow monks. So without further ado, I offer for your consideration a perl one-liner that can help you to know when your box is being probed by sckiddies and crackers.
<p>
[http://pltplp.net/ippl/|ippl] is a *nix packet logger. By configuring it to log suspicous packets in a longer format than mundane packets, and by resolving their source address, you can trivially extract info on nefarious goings-on. The example log below illustrates my web server being probed for nonexistant FTP, DNS, and WINS services.
</p>
<p>
<i>* relevent chunk from ippl.conf:</i><code>
noresolve all
logformat normal all
log options resolve,detaild tcp port ftp
log options resolve,detaild tcp port domain # zone xfer
log options resolve,detaild udp port netbios-ns
etc...</code>
</p>
<p>
<i>* sample lines from ippl.log:</i><code>
Nov 2 20:14:19 www connection attempt from 199.8.65.44
Nov 2 22:03:34 last message repeated 47 time(s)
Nov 2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.com [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov 3 18:03:09 domain connection attempt from cha213245016252.chello.fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)
Nov 4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dialin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)</code>
</p>
<p>
<i>* sample munged output:</i><code>
Nov 2 22:34:49 ftp connection attempt from ts1-850.f1781.quebectel.com [142.169.225.139] (142.169.225.139:21->204.27.0.137:21)
Nov 3 18:03:09 domain connection attempt from cha213245016252.chello.fr [213.245.16.252] (213.245.16.252:4709->204.27.0.137:53)
Nov 4 09:34:28 netbios-ns connection attempt from pD905543D.dip.t-dialin.net [217.5.84.61] (217.5.84.61:4642->204.27.0.137:137)</code>
</p>
<p>
<i><b>* from a perlish perspective</b>, it matches any line containing an open-paren *unless* the paren is immediately preceeded by the word "time". <tt>perldoc [perlman:perlre|perlre]</tt> says that's a zero-width positive lookahead assertion.</i>
</p>
<p>
<b>Update: </b> Hmmm... props to [blakem] for cleaner and more recognizable syntax below. I vaguely recall seeing that in perlre, but must've already had this'un working.
</p>
<br /><br />
<CODE>perl -ne 'print if (/\(/ && $` !~ /time$/)' < ippl.log > ippl.noteworthy</CODE>
<br /></br />