Fwd: Re: Can IP addresses be partially wildcarded w/ `ipfstat -t'?
Jim Klimov <[email protected]> Sun, 28 Aug 2011 03:44:24 +0400
| Newsgroups | gmane.comp.security.firewalls.ipfilter |
|---|---|
| Organization | JSC COS/HT |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------020007030601010508040209 Content-Type: text/plain; charset=windows-1251; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by maildrop2.anu.edu.au id p7RNkIup013005 Forwarding Mike's reply to the list - as I seem to have responded in private to a public discussion. Here follows: -------- =C8=F1=F5=EE=E4=ED=EE=E5 =F1=EE=EE=E1=F9=E5=ED=E8=E5 -------- =D2=E5=EC=E0: Re: Can IP addresses be partially wildcarded w/ `ipfstat -= t'? =C4=E0=F2=E0: Sat, 27 Aug 2011 13:55:52 -0400 (EDT) =CE=F2: Michael T. Davis <[email protected]> =CA=EE=EC=F3: [email protected] At 10:41:03.02 on 27-AUG-2011 in message<[email protected]>, you wr= ote: >Lame reply (since I don't know about this feature in IPF): you can pipe >the output to "egrep", "awk" or "perl -e" -- in order to match the IPs t= o >a certain regexp string. Not very simple or elegant, but solves your >problem =3D) > >Also this way you can more easily match IP ranges which are not >CIDR subnets. > I'm fairly sure this won't work, since the output from `ipfstat -t' is presented in the same way as `top'. That is, it is designed for dynam= ic application-driven screen updating. As a trivial test, I tried this... ipfstat -t -P tcp -D any,22|awk '$2 !=3D "<firewall-ip>,22"' ...but all I could see on the screen was the heading from the `ipfstat -t= ' display: [begin display] <hostname> - IP Filter: v4.1.29 - state top = 13:44:45 Src: 0.0.0.0, Dest: 0.0.0.0,22, Proto: tcp, Sorted by: # bytes [end display] On a related note, another option came to mind. It would be particularly useful to exclude a given host (or network range specified b= y CIDR or addr/mask). If we take the above pipeline as an example, this mi= ght be expressed (assuming `ipfstat -t' supported it and the IP address of th= e firewall was 192.168.0.1) as... ipfstat -t -P tcp -D !192.168.0.1,22 The scope of "!" would be limited to only the IP address or port number, = so that the output would be to any destination on TCP port 22 except 192.168= .0.1. Alternatively, if you wanted to look at all traffic destined for the fire= wall except SSH... ipfstat -t -P tcp -D 192.168.0.1,!22 (The syntax "!any" [and equivalents] for address or port number would be disallowed.) Regards, Mike --------------020007030601010508040209 Content-Type: text/html; charset=windows-1251 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by maildrop2.anu.edu.au id p7RNkIup013005 <html> <head> <meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dwin= dows-1251"> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> <tt>Forwarding Mike's reply to the list - as I seem to have <br> responded in private to a public discussion. Here follows:<br> </tt><br> -------- =C8=F1=F5=EE=E4=ED=EE=E5 =F1=EE=EE=E1=F9=E5=ED=E8=E5 -------= - <table class=3D"moz-email-headers-table" border=3D"0" cellpadding=3D"= 0" cellspacing=3D"0"> <tbody> <tr> <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=D2=E5= =EC=E0: </th> <td>Re: Can IP addresses be partially wildcarded w/ `ipfstat -t'?</td> </tr> <tr> <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=C4=E0= =F2=E0: </th> <td>Sat, 27 Aug 2011 13:55:52 -0400 (EDT)</td> </tr> <tr> <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=CE=F2= : </th> <td>Michael T. Davis <a class=3D"moz-txt-link-rfc2396E" href=3D= "mailto:[email protected]"><[email protected]></a= ></td> </tr> <tr> <th align=3D"RIGHT" nowrap=3D"nowrap" valign=3D"BASELINE">=CA=EE= =EC=F3: </th> <td><a class=3D"moz-txt-link-abbreviated" href=3D"mailto:jim@co= s.ru">[email protected]</a></td> </tr> </tbody> </table> <br> <br> <pre>At 10:41:03.02 on 27-AUG-2011 in message <a class=3D"moz-txt-lin= k-rfc2396E" href=3D"mailto:[email protected]"><4E5901E5.6060108@= cos.ru></a>, you wrote: >Lame reply (since I don't know about this feature in IPF): you can pi= pe >the output to "egrep", "awk" or "perl -e" -- in order to match the IP= s to >a certain regexp string. Not very simple or elegant, but solves your >problem =3D) > >Also this way you can more easily match IP ranges which are not >CIDR subnets. > I'm fairly sure this won't work, since the output from `ipfstat -t' is presented in the same way as `top'. That is, it is designed for dynam= ic application-driven screen updating. As a trivial test, I tried this... ipfstat -t -P tcp -D any,22|awk '$2 !=3D "<firewall-ip>,= 22"' ...but all I could see on the screen was the heading from the `ipfstat -t= ' display: [begin display] <hostname> - IP Filter: v4.1.29 - state top = 13:44:45 Src: 0.0.0.0, Dest: 0.0.0.0,22, Proto: tcp, Sorted by: # bytes [end display] On a related note, another option came to mind. It would be particularly useful to exclude a given host (or network range specified b= y CIDR or addr/mask). If we take the above pipeline as an example, this mi= ght be expressed (assuming `ipfstat -t' supported it and the IP address of th= e firewall was 192.168.0.1) as... ipfstat -t -P tcp -D !192.168.0.1,22 The scope of "!" would be limited to only the IP address or port number, = so that the output would be to any destination on TCP port 22 except 192.168= .0.1. Alternatively, if you wanted to look at all traffic destined for the fire= wall except SSH... ipfstat -t -P tcp -D 192.168.0.1,!22 (The syntax "!any" [and equivalents] for address or port number would be disallowed.) Regards, Mike </pre> </body> </html> --------------020007030601010508040209--