# This is a shell archive. Save it in a file, remove anything before # this line, and then unpack it by entering "sh file". Note, it may # create directories; files and directories will be owned by you and # have default permissions. # # This archive contains: # # ipfcount # ipfcount/Makefile # ipfcount/distinfo # ipfcount/files # ipfcount/files/pkg-message.in # ipfcount/pkg-descr # echo c - ipfcount mkdir -p ipfcount > /dev/null 2>&1 echo x - ipfcount/Makefile sed 's/^X//' >ipfcount/Makefile << 'END-of-ipfcount/Makefile' X# New ports collection makefile for: ipfcount X# Date created: 22 December 2005 X# Whom: Robert Archer X# X# $FreeBSD$ X# X XPORTNAME= ipfcount XPORTVERSION= 0.1 XCATEGORIES= security XMASTER_SITES= http://deathbeforedecaf.net/misc/ports/ \ X http://users.netleader.com.au/~rob/ X XMAINTAINER= freebsd@deathbeforedecaf.net XCOMMENT= Summarise ipf logs by counting and sorting the fields X XPLIST_FILES= bin/ipfcount \ X %%EXAMPLESDIR%%/100.ipfcount XPLIST_DIRS= %%EXAMPLESDIR%% X XMAN1= ipfcount.1 X XSUB_FILES= pkg-message X XUSE_PERL5= yes XUSE_REINPLACE= yes X X.include X X.if ${PERL_LEVEL} < 5006 XIGNORE= requires perl 5.6 or higher - see the lang/perl5.8 port X.endif X Xpost-patch: X ${REINPLACE_CMD} -e '1s,^#![^ ]*,#!${PERL},' ${WRKSRC}/ipfcount X Xdo-build: X cd ${WRKSRC} && pod2man ipfcount > ipfcount.1 X Xdo-install: X ${INSTALL_SCRIPT} ${WRKSRC}/ipfcount ${PREFIX}/bin X ${INSTALL_MAN} ${WRKSRC}/ipfcount.1 ${PREFIX}/man/man1/ipfcount.1 X ${MKDIR} ${EXAMPLESDIR} X ${INSTALL_SCRIPT} ${WRKSRC}/100.ipfcount ${EXAMPLESDIR} X Xpost-install: X @${CAT} ${PKGMESSAGE} X X.include END-of-ipfcount/Makefile echo x - ipfcount/distinfo sed 's/^X//' >ipfcount/distinfo << 'END-of-ipfcount/distinfo' XMD5 (ipfcount-0.1.tar.gz) = 097519ce1972268dda2db0c219aeafa7 XSIZE (ipfcount-0.1.tar.gz) = 3757 END-of-ipfcount/distinfo echo c - ipfcount/files mkdir -p ipfcount/files > /dev/null 2>&1 echo x - ipfcount/files/pkg-message.in sed 's/^X//' >ipfcount/files/pkg-message.in << 'END-of-ipfcount/files/pkg-message.in' X X To summarise ipf(8) logs in your daily security check: X X * Copy %%EXAMPLESDIR%%/100.ipfcount to X %%PREFIX%%/etc/periodic/security X X * Add the line X X daily_status_security_ipfcount_enable="YES" X X to /etc/periodic.conf X END-of-ipfcount/files/pkg-message.in echo x - ipfcount/pkg-descr sed 's/^X//' >ipfcount/pkg-descr << 'END-of-ipfcount/pkg-descr' Xipfcount reads ipf(8) logs and extracts the following fields: X X iface group rule action shost sport dhost dport proto flags type dir X XYou can then print lists like 'top blocked ports', 'top blocked hosts', Xor 'incoming connections sorted by interface and protocol'. X XFor more sophisticated lists, you can filter the entries using Perl expressions. X XWWW: http://deathbeforedecaf.net/misc/ports END-of-ipfcount/pkg-descr exit