Need Some Help

the_Grinch

I'm hoping you guys can help me out with a research project I am working on. I need firewall logs (home computers) of inbound connection attempts. Basically, I am researching where majority of the attempts are coming from and will be mapping/graphing the data. I'm not getting a ton of hits on my computers due to Verizon FiOS modem/router. If you can e-mail the logs to me (feel free to scrub your IP's as I just need the ip's of the computers trying to scan your systems). I am giving my Drexel e-mail so you know it is legit! Thanks in advance!

jrl452@drexel.edu

JDMurray

Can you turn off the firewall on your router and use a second router to set up a DMZ for a honeypot machine? I've wanted to set up a virtual honeypot system on my own ISP's link for some time, but I've never gotten around to getting the necessary hardware together.

the_Grinch

I have the Verizon provided router firewall set to the lowest setting, but I know that not everything is getting through. The kicker is all my stb's get IP addresses so I can't not use it. I've always hated not having just a modem, but nothing I can do about it. I really need some logs, as the research has to be in by Tuesday. At this point I have maybe 5 to 10 IP addresses, not nearly enough to do anything with.

the_Grinch

Thanks for mentioning the DMZ! I can add one host as the DMZ so I will give that a try, though if anyone can send me some logs I would still like them!

wd40

install a torrent client, and start downloading stuff, I'm sure your firewall will get some events.

here is what I have, I hope it helps.

http://www.titansea.com/tmp/bitlord.htm

L0gicB0mb508

the_Grinch wrote: »

I'm hoping you guys can help me out with a research project I am working on. I need firewall logs (home computers) of inbound connection attempts. Basically, I am researching where majority of the attempts are coming from and will be mapping/graphing the data. I'm not getting a ton of hits on my computers due to Verizon FiOS modem/router. If you can e-mail the logs to me (feel free to scrub your IP's as I just need the ip's of the computers trying to scan your systems). I am giving my Drexel e-mail so you know it is legit! Thanks in advance!

jrl452@drexel.edu

If you have an extra computer with two NICS you can always do an inline snort box. That will definitely grab a lot of malicious stuff. Install guides can be found online, and you can set it up in a couple hours. Best of all, its free if you have the hardware laying around. Good luck to you.

the_Grinch

Thanks for the log wd40! Also, as always, thanks for all the help guys!