Skip to content
Permalink
Browse files

Add ability to enable pcap dump collection for attacks. Closes 208

  • Loading branch information...
pavel-odintsov committed Jul 17, 2015
1 parent d143f53 commit 6aa74d489a69814670e969d4f42bbe6042aaf8df
Showing with 8 additions and 1 deletion.
  1. +3 −0 src/fastnetmon.conf
  2. +5 −1 src/fastnetmon.cpp
@@ -127,6 +127,9 @@ notify_script_path = /usr/local/bin/notify_about_attack.sh
# No details passed for "unban" call
notify_script_pass_details = on

# We could collect full dump of attack (with full payload) in pcap compatible format
collect_attack_pcap_dumps = no

# We could put attack details to Redis
redis_enabled = no

@@ -1005,6 +1005,10 @@ bool load_configuration_file() {
notify_script_enabled = false;
}

if (configuration_map.count("collect_attack_pcap_dumps") != 0) {
collect_attack_pcap_dumps = configuration_map["collect_attack_pcap_dumps"] == "on" ? true : false;
}

return true;
}

@@ -2988,7 +2992,7 @@ void send_attack_details(uint32_t client_ip, attack_details current_attack_detai
std::string client_ip_as_string = convert_ip_as_uint_to_string(client_ip);

// Very strange code but it work in 95% cases
if (ban_list_details.count(client_ip) > 0 && ban_list_details[client_ip].size() == ban_details_records_count) {
if (ban_list_details.count(client_ip) > 0 && ban_list_details[client_ip].size() >= ban_details_records_count) {
std::stringstream attack_details;

attack_details << get_attack_description(client_ip, current_attack_details) << "\n\n";

0 comments on commit 6aa74d4

Please sign in to comment.
You can’t perform that action at this time.