GitHub - cd34/ddos-logger: DDOS packet logger using libnids, libgeoip and liblzfx and the associated tools to analyze those logfiles in plaintext.

cd34 / ddos-logger Public

Notifications You must be signed in to change notification settings
Fork 3
Star 2

DDOS packet logger using libnids, libgeoip and liblzfx and the associated tools to analyze those logfiles in plaintext.

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 1 Commit
debian		debian
lzfx-0.1		lzfx-0.1
.gitignore		.gitignore
Makefile		Makefile
README		README
TODO		TODO
comptest.c		comptest.c
ddoslog.c		ddoslog.c
ddoslog.h		ddoslog.h
ddoslog.sh		ddoslog.sh
logview.c		logview.c

Repository files navigation

Initial Log File Format:

<timestamp><attacker ip><dest port><countrycode><attacked IP><src port>[<tcp payload> bzipped]

ASCII delogger

minimal grep for attacker IP, country code, number of lines

Quick instructions:

apt-get install libnids-dev libpcap-dev libgeoip-dev
git clone https://code.google.com/p/ddos-log/
cd ddos-log
cd lzfx-0.1
./configure
make
cd ..
make

You'll need to be root to run ddoslog.bin since it attaches to the ethernet card
and switches it to promiscuous mode.