0

Is there a method or a linux log to record IP addresses (and other network data) that are attempting to talk to a laptop sitting within an enterprise network from that laptop without running pcap-- thinking BYOD environment?

For instance, if I am sitting in an enterprise network and I would like to see "who today attempted to talk to me, either benign or potentially malicious".....could I see "IP X sent 2 ICMP packets at ___" or "IP Y attempted to connect to your box via ssh" or "your local IP connected to IP Z" , all without running tcpdump/wireshark?

I know running PCAP, setting up a firewall, or a honeypot-like Snort sensor (MHN) would tell me this, however, what if I am just a laptop in a BYOD environment and would like to understand the environment better without the resources of running PCAP.

Thanks!

  • 1
    What exactly is wrong with using wireshark? – immibis Mar 6 '17 at 23:14
  • 1
    I was looking for clean logs so I could scale this out a bit more . I suppose I could write a script that runs tcpdump in the background and only save the top level information that I need to a log file. – userJoe Mar 6 '17 at 23:16
  • 1
    Iptables can log packets. You can set it up to drop everything, and log attempts to connect to you. – multithr3at3d Mar 7 '17 at 0:27
  • 2
    @korockinout13 your is a perfectly valid answer imo, perhaps you want to write it as such and claim the glory? (I'd upvote) – Purefan Mar 7 '17 at 10:08
2

An easy way to log any incoming (or outgoing) connection attempts is to use IPtables. IPtables has the ability to log arbitrary information to the syslog. An easy way to accomplish this is to set up a rule in the INPUT chain that sends all unaccepted traffic to a new LOGGING chain, which will output those packets to syslog and finally drop them.

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

Then, you could watch your syslog with:tail -f /var/log/<log_file> | grep IPTables-Dropped Source: http://www.thegeekstuff.com/2012/08/iptables-log-packets/?utm_source=feedburner

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.