Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to use different kind of intrusion detection tools like OpenSource Tripwire. Please suggest me some tools which can provide me some additional information to that provided by tripwire? Secondly, how can I get IP addresses of all the clients of my server? Thirdly, Can I merge logs created by all such tools?

share|improve this question
1  
This first question is unanswerable. You provide no requirements, no indication of why tripwire is not enough or even what you are trying to accomplish. The second question is completely unrelated. Use netstat. –  jordanm Nov 19 '12 at 17:10

1 Answer 1

First a generality: timestamps are crucial. Use NTP to sync your system's clock, make sure that the clock is not wobbling all over the place. After that, you can move on to the basics.

I would suggest running Michal Zalewski's p0f and logging its guesses about incoming TCP requests. I'm using version 2, but Zalewski has a version 3 out.

CERT at Carnegie Mellon has a vastly updated p0f v2.x fingerprint file.

You can run p0f v2.x in the background with an invocation something like this:

p0f -f $FPRINTS -d -t -l -o $LOGFILE

$FPRINTS names the fingerprints file and $LOGFILE names the file in which output ends up.

p0f will give you a pretty decent guess about what operating system your attacker uses. You will have to co-ordinate p0f guesses with any other data you collect.

An alternative: SinFP3. I found it a little tricky to install, as it had some non-standard Perl module dependencies.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.