[7.901][FEATURE][OPEN] IPS attacks not being reported

Hi,
I know this is a duplicate from the prior 7.8xx betas.

I have a number of IPS attacks UDP flood in the log file. Nothing shows on the dashboard or on the reporting graphs.
There are number of lines with similar info for both time periods as well as a later attack.

Ian M

2010:04:11-05:44:34 fw1-on-house ulogd[4313]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="213.154.235.74" dstip="210.84.9.137" proto="17" length="1308" tos="0x08" prec="0x20" ttl="57" srcport="3545" dstport="47262"
2010:04:11-16:41:54 fw1-on-house ulogd[4313]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="95.80.0.220" dstip="210.84.9.137" proto="17" length="1308" tos="0x08" prec="0x20" ttl="51" srcport="3548" dstport="47262"

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report

--------------------------------

Version: 7.901

Type: FEATURE

State: CONFIRMED/OPEN

Reporter: RFCat_vk++

Contributor: 

MantisID: 13440

Target version: 

Fixed in version: 

--------------------------------

0 trollvottel over 15 years ago

This is now declared as a missing feature:

Only data reported by Snort is being reported. Portscan Detection and Flood Detection is logged in ips.log, but is not in Reporting!

It's the same in v7, that's why it's declared as feature.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to trollvottel

So, now we have added a new page to the request feature forum, add the missing feature request.

LOL

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel