I want to isolate some possible attacker IPs. So I'm wondering how to poke to each IP's activity, assuming that web server's access log is disables?
-
have you got a specific operating system and web server in mind?– Mike PenningtonJun 29, 2012 at 12:00
-
I mean in Linux. The title is modified.– alfishJun 29, 2012 at 12:10
-
Why don't you tell us: your OS, your webserver, why you've got logging disabled, why you think there's an attack, what other infrastructure you've got in your application/networking stack (e.g.: upstream firewall, router) which might be able to assist in logging/defending your site, what typical traffic patterns look like (hits or users per day, etc.). This is a very vague, very poorly worded question (with annoying typos/grammatical errors to boot). Short answer: enable logging, analyze your logs.– Dr. Edward MorbiusJun 29, 2012 at 15:13
3 Answers
Why on earth is the log disabled? If you don't have another device between the server and the "attacker" like a reverse proxy, then you're out of luck. You need something to capture and log the requests.
-
The webserver access log is disabled to avoid the enormous write overhead. Maybe network monitoring tools like netstat can be helpful?– alfishJun 29, 2012 at 12:04
-
1@alfish: Enormous write overhead? How much traffic you get?? If everything else fails, set up a separate centralized log server and forward your Apache logs there with Apache
CustomLog
directive andlogger
, that way your log server gets the disk I/O abuse. Jun 29, 2012 at 12:23 -
Janne, what I intend to achieve here is to have a very handy overview of certain IP activitis (e.g. are they using ssh or ftp or http). I agree that for more in-depth 'tracking' I need to have a web server access log. So I modify the title to avoid the mis-reading.– alfishJun 29, 2012 at 12:40
-
1@alfish: You are still being very unclear about your final goal - you are asking a complex thing with a one and a half line question. Getting accurate answers here requires accurate questions, otherwise we can just be like a blind guy skeet shooting. I'll try some blind skeet shooting and offer you
iptraf
. Jun 29, 2012 at 12:45 -
actually iptraf is very close to what I want. could you suggest it as an answer?– alfishJun 29, 2012 at 12:53
You can run SPAN on the switch that the server attaches to, assuming Cisco switches are used. If it's another vendor, consult their docs for their options on this.
SPAN will mirror the traffic to another port on the switch. You can then capture the traffic with a tool like Wireshark (or whatever), and analyze it later.
-
1My experience with IP traffic logging is that it's going to be more verbose (with somewhat less useful information) than a serviceable Apache-style webserver log. If logging capacity is overwhelmed by Apache (assuming the OP isn't trying, say, to do realtime IP lookups, which might well be part of his problem), wireshark would be similarly difficult, though it could be offloaded to another host. Jun 29, 2012 at 15:17
-
In general that's true. But, the poster says he is looking at certain IPs. So, with Wireshark, you can add a filter to the capture to narrow down what's stored. The poster also mentioned figuring out if the IPs were using certain protocols (ssh, ftp, http). Wireshark makes that very easy with its statistics feature.– sjwJun 29, 2012 at 17:28
-
That will get very big, very fast if the traffic is as heavy as the OP makes it out to be. Wireshark has a real problem with packet captures larger than 2GB.– MDMarraJun 29, 2012 at 18:27
Is the web server's error log enabled? You can track down IP addresses from which your server is scanned on different kind of vulnerabilities using the error log. Such scans often fail and therefore are written into the error log as well as secure, auth logs, etc.