[1909] in SIPB-AFS-requests
courtney
daemon@ATHENA.MIT.EDU (marthag@MIT.EDU)
Tue Apr 4 03:07:18 1995
From: marthag@MIT.EDU
Date: Tue, 4 Apr 95 03:06:55 -0400
To: star-maintainers@MIT.EDU
I installed courtney (the SATAN watcher program) in /usr/local/bin on
penguin-lust. I also installed perl5 and tcpdump to do this
(/usr/local/bin/perl and related utilities are now perl5.001, hopefully
this won't break anything).
Courtney is sysloging to user.alert, which now goes to
/var/adm/user.alert, as well /var/adm/messages (user.err), and those who
sub to *.alert (me, ghudson and I just added jhawk at his request).
Courtney watches the output of tcpdump for a number of connections to
interesting ports (it watches 30 ports) in a specified period of time,
and it syslogs if it decides a host is under attack from SATAN.
Penguin-lust is currently watching everything on 18.181 except itself
(it isn't watching 18.70, we may want to set up another machine with
courtney on 18.70 at some point).
Martha
