Mailing List Archive: Anti-Port scan.... (Port Monitor / Logger)

Anti-Port scan.... (Port Monitor / Logger)

Jul 25, 1999, 12:24 PM

Post #1 of 3 (355 views)

Folks,

I know this is a fairly simple program, but this is just a thought
right now.

I'm having some activity on my modem that I can't explain, but I run
OS/2....
So I can't use NUKENABBER, etc, for Windows to monitor the ports on my
"server" box.

I was thinking, it'd be easy to write a python program to grab a port,
and
log the access's.....

But then I was thinking, but how would I grab all the ports
conviently, and
not have to write a billizion sock call statements....

Anyone got a suggestion on how to do this....I would also probably
want to
make it selective, for example, so that I can have my web server still
operational
while this is online....

I'm stumped, but of course, I just got done with moving, and need to
finish unpacking,
etc....

Benjamin

Anti-Port scan.... (Port Monitor / Logger) [ In reply to ]

skip at mojam

Jul 25, 1999, 4:18 PM

Post #2 of 3 (363 views)

Permalink

Benjamin> I'm having some activity on my modem that I can't explain, but
Benjamin> I run OS/2.... So I can't use NUKENABBER, etc, for Windows to
Benjamin> monitor the ports on my "server" box.

Can you run Linux? If so, you can use tcpdump to monitor your ppp
connection. It's the best way to look at what's really happening on your
network. (No Python content, but then there are some things with good
non-Python solutions already.)

Skip Montanaro | http://www.mojam.com/
skip@mojam.com | http://www.musi-cal.com/~skip/
847-475-3758

Anti-Port scan.... (Port Monitor / Logger) [ In reply to ]

junkster at nospam

Jul 25, 1999, 4:31 PM

Post #3 of 3 (362 views)

Permalink

On Sun, 25 Jul 1999 23:18:59, Skip Montanaro <skip@mojam.com> wrote:

> Benjamin> I'm having some activity on my modem that I can't explain, but
> Benjamin> I run OS/2.... So I can't use NUKENABBER, etc, for Windows to
> Benjamin> monitor the ports on my "server" box.

> Can you run Linux? If so, you can use tcpdump to monitor your ppp
> connection. It's the best way to look at what's really happening on your
> network. (No Python content, but then there are some things with good
> non-Python solutions already.)

I could use IPTRACE which I believe is the OS/2 equivalent of
tcpdump...
And I've already isolated it to being non-tcpip traffic.....

But I really would like to try to make a python program to monitor the
ports anyway.....In a nice clean clear format, unlike IPTRACE.... Just
isolate
the "dangerous" bits, and leave me in piece...

Plus IPTRACE dumps way toooooo much data to the drive/log. I would
easily start to eat up tooo much disk space...

- Benjamin