--1Wg5Vd7si6EhrIHA Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 03, 2004 at 09:51:15AM +0000, Francisco Reyes wrote: > My setup 4.9 stable with IPFW. Machine acts as gateway for two machines. >=20 > What are my options on monitoring activity on my external card? >=20 > This morning I noticed my DSL modem activity light is blinking non-stop. > Looking at /var/log/ don't see anything suspicious. >=20 > I feel tempted to add "log" to all my ipfw pass rules, but wonder if there > isn't a better way. >=20 > I am mostly concerned there is either some kind of attack going on or > somehow the machine was hacked and it's running something it's not > supposed to. There are a lot of utilities in the ports collection that will allow you to monitor your network activity. One small and useful one is at net/trafshow. It's not fancy, but it is curses based and will give you a quick idea of what is going on. Other considerations might be ntop or ethereal. Nathan --=20 gpg --keyserver pgp.mit.edu --recv-keys D8527E49 --1Wg5Vd7si6EhrIHA Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQFARfl+O0ZIEthSfkkRAkhAAJ41P443kVhBrq/TtndJSc1c2b/h5ACfcLh4 SnzrTYeHOUNcWGdP/SgLV6o= =oEe8 -----END PGP SIGNATURE----- --1Wg5Vd7si6EhrIHA--