[6.819] E-mail notification on Portscan can't be set - fixed

In "management->Notifications->Notifications" the option "Intrusion Protection" you can set to alert by "e-mail". When I enable this option (doesn't matter wich one or all) and I use the "apply"-button it says it's done. But when I go to another tab or other part of the configuration and come back to alert by email Intrusion Protection all my marks are disappeared!!! In 6.808 i didn't had this problem is this a bug????

PS: I use grc.com to scan my ports....

0 Suppentrulli over 18 years ago

Hi, it doesn't work on ANY option... not only portscan-detection
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Suppentrulli over 18 years ago in reply to Suppentrulli

This seems to be fixed with 6.836.

Does anyone know in which logfile portscan-messages are written?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gert Hansen over 18 years ago in reply to Suppentrulli

Hi,

yes you should find them in the packetfilter.log.

Regards
Gert
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Suppentrulli over 18 years ago in reply to Gert Hansen

Hi Gert,

and what is the "portscan"-log in the webadmin-logfile-section intended for? It is always empty...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gert Hansen over 18 years ago in reply to Suppentrulli

Hi there,

In V6 we had a seperate portscan log, i think this is some leftover from V6.

It is not used till now, we are still evaluating if we should split the portscan.log the packetfilter log, which will somehow reduce the loggingperformance.

The list of logfiles listed there is not yet final.

regards
Gert
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Suppentrulli over 18 years ago in reply to Gert Hansen

Ok, thanks Gert.

Another question: with portscan-detection enabled i have about ~1000 assumed portscans a day, source-ip is in almost all cases my own client! But i did not do a portscan... What does fwrule=60017 mean?

2006:11:19-18:30:38 (none) ulogd[2544]: id="2015" severity="info" sys="SecureNet" sub="packetfilter" name="portscan detected" action="portscan" fwrule="60017" initf="eth1" outitf="ppp0" dstmac="00:02:a5:f3:5b:a8" srcmac="00:13:02:60:97:b6" srcip="192.16.0.10" dstip="217.11.xx.xx" proto="6" length="48" tos="0x00" prec="0x00" ttl="127" srcport="1037" dstport="110" tcpflags="SYN"

two days ago my portscan email-notification was switched on, so i got about 1800 emails... [:(]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel