Bug 92454 - New port: security/ipfwcount Summarise ipfw logs by counting and sorting the fields
Summary: New port: security/ipfwcount Summarise ipfw logs by counting and sorting the ...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Aaron Dalton
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-01-28 13:10 UTC by Robert Archer
Modified: 2006-05-13 17:34 UTC (History)
0 users

See Also:


Attachments
file.shar (2.91 KB, text/plain)
2006-01-28 13:10 UTC, Robert Archer
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Archer 2006-01-28 13:10:03 UTC
ipfwcount reads ipfw(8) logs and extracts the following fields:

  rule action proto type shost sport dhost dport dir iface

You can then print lists like 'top <n> blocked ports', 'top <n> blocked hosts',
or 'incoming connections sorted by interface and protocol'.

For more sophisticated lists, you can filter the entries using Perl expressions.

WWW: http://deathbeforedecaf.net/misc/ports

Fix: Archive is at http://deathbeforedecaf.net/misc/patches/ipfwcount.2006-01-28
Comment 1 Aaron Dalton freebsd_committer freebsd_triage 2006-02-20 18:13:45 UTC
Responsible Changed
From-To: freebsd-ports-bugs->aaron

Take.
Comment 2 Aaron Dalton freebsd_committer freebsd_triage 2006-02-20 22:00:11 UTC
State Changed
From-To: open->feedback

Ask for submitter fix.
Comment 3 Aaron Dalton freebsd_committer freebsd_triage 2006-02-20 22:00:21 UTC
Hi, Robert!  Would you mind updating your Makefile to respect the 
NOPORTDOCS variable please?  Example files are indeed considered 
documents.  Your plist will also have to be adjusted accordingly.

   .if !defined(NOPORTDOCS)
     ...install docs/examples...
   .endif

Just submit the new shar as a follow-up to this PR.  No need to open a 
new one.  Thanks!

-- 
Aaron Dalton
aaron@FreeBSD.org
FreeBSD Ports Committer
Comment 4 Robert Archer 2006-02-22 13:06:11 UTC
On 21/02/2006, at 8:30 AM, Aaron Dalton wrote:

> Hi, Robert!  Would you mind updating your Makefile to respect the  
> NOPORTDOCS variable please?  Example files are indeed considered  
> documents.  Your plist will also have to be adjusted accordingly.

Aaron,

New archive is at http://deathbeforedecaf.net/misc/patches/ipfwcount. 
2006-02-22

I've set PORTREVISION because these updates (if committed) should  
also be made to security/ipfcount, and I want to keep the versions in  
sync.

Thanks
Rob.
Comment 5 Robert Archer 2006-04-24 15:19:49 UTC
Aaron,

Do these changes look OK? I'd like to update security/ipfcount once  
they're committed.

Rob.
Comment 6 Aaron Dalton freebsd_committer freebsd_triage 2006-05-10 01:27:18 UTC
Rob, I apologize for the extended delay.  Life has been merciless.  I 
was unable to follow the link you provided but a little url munging 
found me the file ipfwcount.2006-02-22 which I believe is what you 
wanted.  I am processing this now.

-- 
Aaron Dalton
aaron@FreeBSD.org
FreeBSD Ports Committer
Comment 7 Aaron Dalton freebsd_committer freebsd_triage 2006-05-10 01:41:22 UTC
State Changed
From-To: feedback->open

Feedback received.
Comment 8 Aaron Dalton freebsd_committer freebsd_triage 2006-05-13 17:34:18 UTC
State Changed
From-To: open->closed

New port added. Thanks!