1

I'm running a RHEL 6 Linux server and receive about 3000-5000 hits on my iptables logs daily and I want to see all hits on the iptables, source address, source network name, ports, hit counts etc.

Is there any advanced iptables analysis tool that can evaluate attacks in server through any web interface, which is what I'm really interested in?

Scott Pack
  • 14,717
  • 10
  • 51
  • 83

3 Answers3

2

If you want a monitoring tool, you can use Snort like khaled suggested, another Open source tool is OSSEC.

It has many rules to provide monitoring for webservers,mailservers,ssh authentication... It sends you an email when things look fishy and can also, when configured, block those IP's. They have server-client model. I wrote an introduction and guide on how to use it here.

Lucas Kauffman
  • 16,818
  • 9
  • 57
  • 92
1

Did you look at Intrusion Detection Systems? Snort is a well-known open-source IDS. This software can sit on your gateway and monitor your traffic to raise alarms/alerts based on different criteria.

Khaled
  • 35,688
  • 8
  • 69
  • 98
1

A nice and simple tool would be fwanalog. It is based on the old Analog package that provides anaylsis for Apache logs. FWanalog is fairly quick to setup and provides some nice high level breakdown of the firewall blocks.

For more in depth reporting I would look at something more like Splunk or OSSEC, both of which are excellent tools. FWanalog, however, can be setup and trialed significantly faster, however.

Scott Pack
  • 14,717
  • 10
  • 51
  • 83