diff options
Diffstat (limited to 'net-analyzer/p0f/files')
-rw-r--r-- | net-analyzer/p0f/files/digest-p0f-2.0.5-r1 | 1 | ||||
-rw-r--r-- | net-analyzer/p0f/files/p0f.confd | 3 | ||||
-rwxr-xr-x | net-analyzer/p0f/files/p0f.initd2 | 38 |
3 files changed, 42 insertions, 0 deletions
diff --git a/net-analyzer/p0f/files/digest-p0f-2.0.5-r1 b/net-analyzer/p0f/files/digest-p0f-2.0.5-r1 new file mode 100644 index 000000000000..07d6ee7ea1cd --- /dev/null +++ b/net-analyzer/p0f/files/digest-p0f-2.0.5-r1 @@ -0,0 +1 @@ +MD5 78235749e8ada6ad2b16b40fe15081f6 p0f-2.0.5.tgz 130002 diff --git a/net-analyzer/p0f/files/p0f.confd b/net-analyzer/p0f/files/p0f.confd new file mode 100644 index 000000000000..ae3a068cebad --- /dev/null +++ b/net-analyzer/p0f/files/p0f.confd @@ -0,0 +1,3 @@ +P0FLOGFILE=/var/log/p0f-audit.log +P0FDEVICE=eth0 +P0FOPTIONS="-tdlo" diff --git a/net-analyzer/p0f/files/p0f.initd2 b/net-analyzer/p0f/files/p0f.initd2 new file mode 100755 index 000000000000..f32f11ca82c0 --- /dev/null +++ b/net-analyzer/p0f/files/p0f.initd2 @@ -0,0 +1,38 @@ +#!/sbin/runscript +# Copyright 1999-2004 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/p0f/files/p0f.initd2,v 1.1 2005/06/19 01:54:40 vanquirius Exp $ + +start() { + ebegin "Starting p0f" + # The 'tcp and tcp[13] & 2 = 2' requires at least syn set. + # An alternative would be 'tcp and tcp[13] & 0x3f = 2', which + # is syn and no other major flags (but ECN enabled packets are OK) + if [ -z "$BpfFilter" ]; then + BpfFilter='tcp and tcp[13] & 2 = 2' + else + BpfFilter="$BpfFilter and tcp and tcp[13] & 2 = 2" + fi + + # The command in backticks returns all the local IP addresses on this machine. + for OneIP in `/sbin/ifconfig 2>/dev/null | grep 'inet addr' | sed -e 's/.*addr://' -e 's/ .*//'` ; do + BpfFilter="$BpfFilter and not src host $OneIP" + done + + # Create a lock file. + mkdir -p /var/lock/subsys + touch /var/lock/subsys/p0f + + # Start up p0f and filter out all packets originating from any of this machines IP's. + einfo "Logfile: ${P0FLOGFILE}" + start-stop-daemon --start --quiet --exec /usr/sbin/p0f -- -i "${P0FDEVICE}" \ + "${P0FOPTIONS}" "${P0FLOGFILE}" "${BpfFilter}" >> "/var/log/p0f" 2>&1 & + eend ${?} +} + +stop() { + ebegin "Stopping p0f" + start-stop-daemon --stop --quiet --exec /usr/sbin/p0f + rm -f /var/lock/subsys/p0f + eend ${?} +} |