I want to use different kind of intrusion detection tools like OpenSource Tripwire. Please suggest me some tools which can provide me some additional information to that provided by tripwire? Secondly, how can I get IP addresses of all the clients of my server? Thirdly, Can I merge logs created by all such tools?

  • 1
    This first question is unanswerable. You provide no requirements, no indication of why tripwire is not enough or even what you are trying to accomplish. The second question is completely unrelated. Use netstat. – jordanm Nov 19 '12 at 17:10

First a generality: timestamps are crucial. Use NTP to sync your system's clock, make sure that the clock is not wobbling all over the place. After that, you can move on to the basics.

I would suggest running Michal Zalewski's p0f and logging its guesses about incoming TCP requests. I'm using version 2, but Zalewski has a version 3 out.

CERT at Carnegie Mellon has a vastly updated p0f v2.x fingerprint file.

You can run p0f v2.x in the background with an invocation something like this:

p0f -f $FPRINTS -d -t -l -o $LOGFILE

$FPRINTS names the fingerprints file and $LOGFILE names the file in which output ends up.

p0f will give you a pretty decent guess about what operating system your attacker uses. You will have to co-ordinate p0f guesses with any other data you collect.

An alternative: SinFP3. I found it a little tricky to install, as it had some non-standard Perl module dependencies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.