Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to isolate some possible attacker IPs. So I'm wondering how to poke to each IP's activity, assuming that web server's access log is disables?

share|improve this question
    
have you got a specific operating system and web server in mind? –  Mike Pennington Jun 29 '12 at 12:00
    
I mean in Linux. The title is modified. –  alfish Jun 29 '12 at 12:10
    
Why don't you tell us: your OS, your webserver, why you've got logging disabled, why you think there's an attack, what other infrastructure you've got in your application/networking stack (e.g.: upstream firewall, router) which might be able to assist in logging/defending your site, what typical traffic patterns look like (hits or users per day, etc.). This is a very vague, very poorly worded question (with annoying typos/grammatical errors to boot). Short answer: enable logging, analyze your logs. –  Dr. Edward Morbius Jun 29 '12 at 15:13
add comment

3 Answers

Why on earth is the log disabled? If you don't have another device between the server and the "attacker" like a reverse proxy, then you're out of luck. You need something to capture and log the requests.

share|improve this answer
    
The webserver access log is disabled to avoid the enormous write overhead. Maybe network monitoring tools like netstat can be helpful? –  alfish Jun 29 '12 at 12:04
1  
@alfish: Enormous write overhead? How much traffic you get?? If everything else fails, set up a separate centralized log server and forward your Apache logs there with Apache CustomLog directive and logger, that way your log server gets the disk I/O abuse. –  Janne Pikkarainen Jun 29 '12 at 12:23
    
Janne, what I intend to achieve here is to have a very handy overview of certain IP activitis (e.g. are they using ssh or ftp or http). I agree that for more in-depth 'tracking' I need to have a web server access log. So I modify the title to avoid the mis-reading. –  alfish Jun 29 '12 at 12:40
1  
@alfish: You are still being very unclear about your final goal - you are asking a complex thing with a one and a half line question. Getting accurate answers here requires accurate questions, otherwise we can just be like a blind guy skeet shooting. I'll try some blind skeet shooting and offer you iptraf. –  Janne Pikkarainen Jun 29 '12 at 12:45
    
actually iptraf is very close to what I want. could you suggest it as an answer? –  alfish Jun 29 '12 at 12:53
add comment

You can run SPAN on the switch that the server attaches to, assuming Cisco switches are used. If it's another vendor, consult their docs for their options on this.

SPAN will mirror the traffic to another port on the switch. You can then capture the traffic with a tool like Wireshark (or whatever), and analyze it later.

share|improve this answer
1  
My experience with IP traffic logging is that it's going to be more verbose (with somewhat less useful information) than a serviceable Apache-style webserver log. If logging capacity is overwhelmed by Apache (assuming the OP isn't trying, say, to do realtime IP lookups, which might well be part of his problem), wireshark would be similarly difficult, though it could be offloaded to another host. –  Dr. Edward Morbius Jun 29 '12 at 15:17
    
In general that's true. But, the poster says he is looking at certain IPs. So, with Wireshark, you can add a filter to the capture to narrow down what's stored. The poster also mentioned figuring out if the IPs were using certain protocols (ssh, ftp, http). Wireshark makes that very easy with its statistics feature. –  sjw Jun 29 '12 at 17:28
    
That will get very big, very fast if the traffic is as heavy as the OP makes it out to be. Wireshark has a real problem with packet captures larger than 2GB. –  MDMarra Jun 29 '12 at 18:27
add comment

Is the web server's error log enabled? You can track down IP addresses from which your server is scanned on different kind of vulnerabilities using the error log. Such scans often fail and therefore are written into the error log as well as secure, auth logs, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.