I'd like a log of which *interface* the packet is heading to -- "port"
in the sense of physical port, not in the UDP/TCP virtual port sense.
If one of my users forges a packet from their machine that trips my
spoof preventer, I'd like to know what line they were logged on to,
instead of having to attempt to possibly correlate a collection of
logfiles with the list of users who were on that portmaster at that
time to determine who'd been sending the bogus packets.
-Dave
> From: girsch@marben.com (Arnaud Girsch)
>
> errr .... It's already there.
> The src/dst #IP is followed by the port. Look at (for example):
>
> Apr 11 01:05:06 router-gw 28 deny: UDP from 130.237.226.85.3685 to W.X.Y.Z.518
>
> And you have the same behaviour for TCP.
>
> Arnaud.
>
> --
> Arnaud Girsch -+- agirsch@marben.com -+- Marben Products, Inc. - San Jose, CA