Advanced

Netward in Beta

Posted by jayrfink on · Post a comment
Systhread ; By Jason (Jay) R Fink 		Mail this story
Print this story

The netward program, a simple hey why are you connecting to that program has entered beta stage. The program uses libpcap to detect when a port should not be accessed and logs. Currently plans for the program are to add one more tweak to cut down on noise for admins and possibly add an event handler script.

As anyone who has followed the site knows (all two or three of you) Netward was rewritten from the ground up. It is now, finally a year later in BETA stage. It now sports all of the following features:



  • A configuration file instead of all on the command line.
  • Two timers for detection; how many packets to poll and how often.
  • Full libpcap filter syntax support. Why reinvent the wheel?
  • Logging support.
  • Config file and logfile can be changed from default via the command line or within the header at build time.


The only work left is it would be nice if there was another control mechanism a sysadmin could tweak that says after n hits actually alarm instead of just log it all now. The problem is the potential to have a lot of redundant entries. For instance if netward uses a poll rate of 1/10 sec and sample 1024 packets the logfile could fill up quick. It might be better to say don't start logging until N.

Full Story

  Nav
» Read more about: Story Type: News Story

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

Comments

No comments yet. Be the first.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post