[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: How can I get all IP transactions (in/out) logged?

On Wed, Jul 28, 2004 at 10:39:07AM +0800, John Summerfield wrote:
| James Foster wrote:
| >>The log will be _enormous_  and I mean __enormous__
| >
| >It seems to me that the log won't necessarily be very large. It really
| >depends on how the connection is being used, doesn't it? An hours
| >worth of log from a dialup connection couldn't be very large, for
| >example.
| >
| I regularly pull 5K bytes/sec. That's a lot of transactions p/h, even on 
| dialup.

Bandwidth does not (directly) affect the number of transactions.  Just
imagine a trivial program designed to DoS the requested logger.  All
it has to do is open and close a connection repeatedly.  That requires
sending a SYN, receiving a SYN-ACK, sending an ACK, then sending the
FIN sequence.  This is only a handful of bytes, so the bandwidth
limitations of a dial-up connection won't prevent the logs from
growing very large very rapidly.


Love is not affectionate feeling, but a steady wish for the loved
person's ultimate good as far as it can be obtained.
    --C.S. Lewis
www: http://dman13.dyndns.org/~dman/            jabber: dman@dman13.dyndns.org

Attachment: signature.asc
Description: Digital signature

Reply to: