Goto www.FinchHaven.com
Goto the computer systems of FinchHaven
Firewall incidents
at the FinchHaven datacenter
Hideously out-of-date! This is from about August of 2002 :-/
Each page represents one or more incidents from my firewall log files that I found interesting.
For the most part, what you'll see is a record of each incident as recorded by snort 1.8.7 (the lines containing greatwall snort: ), ipchains (which is the firewall itself -- the lines containing greatwall kernel: ), and by p0f (which is a passive OS detection program) if the packet is of protocol tcp...
I add whois information for the IP address using bwwhois, a hostname lookup using host(1), and add some commentary if the probe is remarkable in any way ;-)
(At the moment, I'm trying to re-name the incident files to a more meaningful syntax that contains the protocol:port, rather than the time-of-day -- so bear with me for a while...)
Also here are some older bulk logs for entire 24 hour periods, in a different format based upon my revisions to Dan Swan's snort2html.pl, focusing on source IP and host, and source and destination ports.
![[ Join DShield and Fight Back! ]](http://www.dshield.org/images/dshield_live_banner.png)
![[ FinchHaven Data Center ]](../../art/computers/system598a.jpg)
The firewall box itself is the smaller one on the left, under the USR Courier 56K V-Everything modem. It's got an Asus P/I-P55TP4N mobo with a Pentium 150 Classic, 96mb RAM, and it's running Red Hat Linux 6.2 - no X - 6 consoles with CLI only.
In between the firewall box and the ViewSonic G773 monitor is a Linksys ProConnect KVM switch, and on top of that is my cute little SMC EtherEZ 5-port hub!