Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running a RHEL 6 Linux server and receive about 3000-5000 hits on my iptables logs daily and I want to see all hits on the iptables, source address, source network name, ports, hit counts etc.

Is there any advanced iptables analysis tool that can evaluate attacks in server through any web interface, which is what I'm really interested in?

share|improve this question

closed as off-topic by mdpc, HopelessN00b Jan 24 at 2:46

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

If you want a monitoring tool, you can use Snort like khaled suggested, another Open source tool is OSSEC.

It has many rules to provide monitoring for webservers,mailservers,ssh authentication... It sends you an email when things look fishy and can also, when configured, block those IP's. They have server-client model. I wrote an introduction and guide on how to use it here.

share|improve this answer

Did you look at Intrusion Detection Systems? Snort is a well-known open-source IDS. This software can sit on your gateway and monitor your traffic to raise alarms/alerts based on different criteria.

share|improve this answer

A nice and simple tool would be fwanalog. It is based on the old Analog package that provides anaylsis for Apache logs. FWanalog is fairly quick to setup and provides some nice high level breakdown of the firewall blocks.

For more in depth reporting I would look at something more like Splunk or OSSEC, both of which are excellent tools. FWanalog, however, can be setup and trialed significantly faster, however.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.