|
||||||||
I'm looking to write a killer .Net Syslog exclusive for M0N0Wall with formatted output for a realtime display. Maybe export to SQL, Alerts... etc all the goodies. I already have many IP projects that run 24/7 without fail on my Socket class so the Comm is already written and surly tested so writting this app will be almost trivial. I also plan to post the source code so that others can make changes it they like. My goal is really to give me the same look as if this was just an extention of M0N0Wall except it is in real time and runs on a client. I desire to use the same great color scheme. To do this I need help with a few items. reading the raw logs there are a few items that I am not sure of in their meaning.. Please help me with the description of these items. Also if anybody would be gracious enough to send me any weird lines that they get that is out of the norm such as this one I came accross. 09:16:50.302903 rl0 @0:17 b 217.81.173.76 -> 9.3.18.20 PR icmp len 20 56 icmp unreach/port for 9.3.18.20,13794 - 192.168.0.34,4675 PR udp len 20 61 IN 09:26:54.775565 rl0 @0:15 b 68.248.200.13,63021 -> 9.3.18.20,13802 PR tcp len 20 40 -AR IN |-Time---------| IF ? ? Src , Port Dest , Port ? Prot ? ? ? ? ? -S ? Are these TCP packet flags? Ack Syn etc? -AF ? -AFP ? -AP ? -Pat 09:24:41.188275 rl0 @0:17 b 66.132.253.215,3928 -> 69.33.178.214,1080 PR tcp len 20 48 -S IN 09:24:40.950029 rl0 @0:17 b 66.132.253.215,3913 -> 9.3.18.20,1080 PR tcp len 20 48 -S IN 09:24:38.009032 rl0 @0:17 b 66.132.253.215,3918 -> 69.33.178.211,1080 PR tcp len 20 48 -S IN 09:24:38.008883 rl0 @0:17 b 66.132.253.215,3913 -> 9.3.18.20,1080 PR tcp len 20 48 -S IN 09:24:34.239139 rl0 @0:17 b 69.42.65.104,52200 -> 9.3.18.20,113 PR tcp len 20 60 -S IN 09:23:29.132812 rl0 @0:15 b 82.120.24.40,3792 -> 192.2.3.4,4201 PR tcp len 20 40 -AF IN 09:22:53.943146 rl0 @0:17 b 202.105.21.247,1055 -> 69.33.178.212,1434 PR udp len 20 404 IN 09:22:38.114079 rl0 @0:15 b 82.120.24.40,3792 -> 192.2.3.4,4201 PR tcp len 20 40 -AF IN 09:22:12.159733 rl0 @0:15 b 82.120.24.40,3792 -> 192.2.3.4,4201 PR tcp len 20 40 -AF IN 09:21:15.131251 rl0 @0:17 b 69.42.65.104,46234 -> 9.3.18.20,113 PR tcp len 20 60 -S IN 09:20:54.143636 rl0 @0:17 b 69.42.65.104,46234 -> 9.3.18.20,113 PR tcp len 20 60 -S IN 09:16:50.302903 rl0 @0:17 b 217.81.173.76 -> 9.3.18.20 PR icmp len 20 56 icmp unreach/port for 9.3.18.20,13794 - 192.168.0.34,4675 PR udp len 20 61 IN 09:14:39.252967 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 239 -AFP IN 09:14:31.523658 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 108 -AFP IN 09:13:18.484451 rl0 @0:17 b 83.31.83.69,2214 -> 69.33.178.214,135 PR tcp len 20 48 -S IN 09:13:15.498901 rl0 @0:17 b 83.31.83.69,2214 -> 69.33.178.214,135 PR tcp len 20 48 -S IN 09:13:05.394718 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 108 -AFP IN 09:13:03.226206 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 239 -AFP IN 09:12:25.151444 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 40 -AF IN 09:12:23.501803 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 40 -AF IN 09:12:15.321926 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 239 -AP IN 09:12:13.738375 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 108 -AP IN 09:11:51.260291 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 239 -AP IN 09:11:50.235581 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 108 -AP IN 09:11:40.666172 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 108 -AP IN 09:11:39.230193 rl1 @0:15 b 192.2.3.4,4201 -> 62.39.214.102,4227 PR tcp len 20 239 -AP IN 09:11:36.593161 rl0 @0:15 b 62.39.214.102,4227 -> 192.2.3.4,4201 PR tcp len 20 40 -A IN |