summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to 'net-analyzer/p0f/files')
-rw-r--r--net-analyzer/p0f/files/digest-p0f-2.0.5-r11
-rw-r--r--net-analyzer/p0f/files/p0f.confd3
-rwxr-xr-xnet-analyzer/p0f/files/p0f.initd238
3 files changed, 42 insertions, 0 deletions
diff --git a/net-analyzer/p0f/files/digest-p0f-2.0.5-r1 b/net-analyzer/p0f/files/digest-p0f-2.0.5-r1
new file mode 100644
index 000000000000..07d6ee7ea1cd
--- /dev/null
+++ b/net-analyzer/p0f/files/digest-p0f-2.0.5-r1
@@ -0,0 +1 @@
+MD5 78235749e8ada6ad2b16b40fe15081f6 p0f-2.0.5.tgz 130002
diff --git a/net-analyzer/p0f/files/p0f.confd b/net-analyzer/p0f/files/p0f.confd
new file mode 100644
index 000000000000..ae3a068cebad
--- /dev/null
+++ b/net-analyzer/p0f/files/p0f.confd
@@ -0,0 +1,3 @@
+P0FLOGFILE=/var/log/p0f-audit.log
+P0FDEVICE=eth0
+P0FOPTIONS="-tdlo"
diff --git a/net-analyzer/p0f/files/p0f.initd2 b/net-analyzer/p0f/files/p0f.initd2
new file mode 100755
index 000000000000..f32f11ca82c0
--- /dev/null
+++ b/net-analyzer/p0f/files/p0f.initd2
@@ -0,0 +1,38 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/p0f/files/p0f.initd2,v 1.1 2005/06/19 01:54:40 vanquirius Exp $
+
+start() {
+ ebegin "Starting p0f"
+ # The 'tcp and tcp[13] & 2 = 2' requires at least syn set.
+ # An alternative would be 'tcp and tcp[13] & 0x3f = 2', which
+ # is syn and no other major flags (but ECN enabled packets are OK)
+ if [ -z "$BpfFilter" ]; then
+ BpfFilter='tcp and tcp[13] & 2 = 2'
+ else
+ BpfFilter="$BpfFilter and tcp and tcp[13] & 2 = 2"
+ fi
+
+ # The command in backticks returns all the local IP addresses on this machine.
+ for OneIP in `/sbin/ifconfig 2>/dev/null | grep 'inet addr' | sed -e 's/.*addr://' -e 's/ .*//'` ; do
+ BpfFilter="$BpfFilter and not src host $OneIP"
+ done
+
+ # Create a lock file.
+ mkdir -p /var/lock/subsys
+ touch /var/lock/subsys/p0f
+
+ # Start up p0f and filter out all packets originating from any of this machines IP's.
+ einfo "Logfile: ${P0FLOGFILE}"
+ start-stop-daemon --start --quiet --exec /usr/sbin/p0f -- -i "${P0FDEVICE}" \
+ "${P0FOPTIONS}" "${P0FLOGFILE}" "${BpfFilter}" >> "/var/log/p0f" 2>&1 &
+ eend ${?}
+}
+
+stop() {
+ ebegin "Stopping p0f"
+ start-stop-daemon --stop --quiet --exec /usr/sbin/p0f
+ rm -f /var/lock/subsys/p0f
+ eend ${?}
+}