Re: tcp_audit patch

Chris Wedgwood (cw@ix.net.nz)
Tue, 27 Apr 1999 05:58:39 +1200


On Mon, Apr 26, 1999 at 01:51:01PM -0400, Russell Berry wrote:

> Some time ago, in the 2.0.x kernel era, somebody submitted a patch
> for strobe protection, this patch also had a tcp audit facility
> like tcpd does, sending accepts and rejects to syslog. I liked
> this part of it, and have modified it for 2.2.6 kernel. I haven't
> formally posted it anywhere yet, as I cannot contact the orignal
> author for the 2.0.x kernel, and he deserves proper credit, all I
> did was make it work in 2.2.x. I'll attach it here for anyone who
> wants to use it, and if anyone can locate the original author,
> please let me know.

At the very least, this should be tunable via a sysctl. If I run
strobe from several difference sources on your machine, your syslog
is going to get very full...

-cw

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/