RE: [cobalt-users] Cobalt SHP & Portsans

["Jozsef Szilagyi" <j.szilagyi@xxxxxxxxxxxxxxx>]

Hi !
>> The logs:
>> eth0:portscan: 3/3/icmp x.x.x.x3 -> x.x.x.x2 102 (22)
>> 
>> Is anybody can explain what's mean each column ?
>
>The mail usually only contains one line per incident?! 

Yes the mail's only contain one entries.


>There is however a logfile (/var/log/phoenix.log) that shows the time
and date as well. I also found
http://www.sun.com/hardware/serverappliances/pdfs/manuals/manual.adaptiv
e-firewall.pdf 
>
>On page 61 starts a chapter 'Understanding the Adaptive Firewall Log
File'. 

Thank's for the link.


>The "firewall file" the document mentions seems to be at
/etc/scandetection/scandetection.fwall
>
>Sorry, can't tell you what's going on in your box, maybe you can
compare the timestamps with entries in other logfiles ...
I try to figure out the problem.

Thank you,
Jozsef Szilagyi.