Knowledgebase

CSF blocking and logging

Posted by MACscr, 06-27-2011, 02:23 PM

Ok, so I have a couple servers at Continuum and they unfortunately do not provide vlans for my current page unless I want to pay extra for them (seems rather pathetic). Unfortunately because of this, I get tons of "discovery" attempts at my servers from other devices at the DC and my /var/log/messages log ends up getting filled up with 10 requests every second from different ip's at the DC. Post being to port 5678. I am using CSF to manage things, so I was wondering if there is a way I can continue to block them, but have my logging setup so that a certain ip range isnt logged and thus I dont see a bunch of junk in my messages log?

Posted by Dexqt, 06-29-2011, 02:06 AM

Probably just servers from within the same network, or even the same rack that have been compromised and are scanning the networks subnets, then again it could be random scanning by the provider themselves, I know LSN does sort of the same thing.. if you do get sick of it just blacklist the entire IP block would be my best guess.

Add to Favourites

Print this Article