Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a RHEL 6 Linux server and receive about 3000-5000 hits on my iptables logs daily and I want to see all hits on the iptables, source address, source network name, ports, hit counts etc.

Is there any advanced iptables analysis tool that can evaluate attacks in server through any web interface, which is what I'm really interested in?

share|improve this question

3 Answers 3

If you want a monitoring tool, you can use Snort like khaled suggested, another Open source tool is OSSEC.

It has many rules to provide monitoring for webservers,mailservers,ssh authentication... It sends you an email when things look fishy and can also, when configured, block those IP's. They have server-client model. I wrote an introduction and guide on how to use it here.

share|improve this answer

Did you look at Intrusion Detection Systems? Snort is a well-known open-source IDS. This software can sit on your gateway and monitor your traffic to raise alarms/alerts based on different criteria.

share|improve this answer

A nice and simple tool would be fwanalog. It is based on the old Analog package that provides anaylsis for Apache logs. FWanalog is fairly quick to setup and provides some nice high level breakdown of the firewall blocks.

For more in depth reporting I would look at something more like Splunk or OSSEC, both of which are excellent tools. FWanalog, however, can be setup and trialed significantly faster, however.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.