OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Jan Johansson (janj+openbsd_at_wenf.org)
Date: Tue Aug 06 2002 - 03:28:46 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Tue, Aug 06, 2002 at 09:05:44AM +0200, Han wrote:
    > #!/bin/sh
    > /usr/sbin/tcpdump -e -n -tttv -r /var/log/pflog > /tmp/pflog.txt
    > /usr/local/sbin/pf.pl
    > rm /tmp/pflog.txt
    > kill -HUP `cat /var/run/pflogd.pid`

    If you skip the filename in dshield.conf pf.pl will read from
    standard in and you do not need the dangerous /tmp file handling.

    This is in my root crontab.
    0 */6 * * * /usr/sbin/tcpdump -n -e -tttv -r /var/log/pflog | /usr/local/sbin/pf.pl