Hi,
this was reported as being fixed, so maybe I am barking up the wrong tree.
Are the following entries counted as attacks or just information?
2010:03:03-00:33:04 fw1-on-house ulogd[4286]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="69.28.227.212" dstip="124.168.44.163" proto="17" length="407" tos="0x08" prec="0x20" ttl="233" srcport="500" dstport="500"
2010:03:03-00:33:04 fw1-on-house ulogd[4286]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="69.28.227.212" dstip="124.168.44.163" proto="17" length="407" tos="0x08" prec="0x20" ttl="233" srcport="500" dstport="500"
2010:03:03-00:36:47 fw1-on-house ulogd[4286]: id="2104" severity="info" sys="SecureNet" sub="ips" name="ICMP flood detected" action="ICMP flood" fwrule="60014" initf="ppp0" srcip="69.28.227.212" dstip="124.168.44.163" proto="1" length="528" tos="0x08" prec="0x20" ttl="42" type="9" code="0"
2010:03:03-00:36:47 fw1-on-house ulogd[4286]: id="2104" severity="info" sys="SecureNet" sub="ips" name="ICMP flood detected" action="ICMP flood" fwrule="60014" initf="ppp0" srcip="69.28.227.212" dstip="124.168.44.163" proto="1" length="528" tos="0x08" prec="0x20" ttl="42" type="9" code="0"
Extract for the IPS log, but do not showup on any reports.
Ian M
