Home › Forums › BlockHosts

new regex needed

Fri, 2008–Oct–17

Oct 17 10:10:52 localhost [74700.785235] IPT: NEW not SYN (rejected): IN=eth0 OUT= MAC=00:0e:a6:80:c6:30:00:1b:11:76:6d:dc:08:00 SRC=77.232.15.241 DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=60008 DF PROTO=TCP SPT=34861 DPT=6881 WINDOW=1024 RES=0x00 ACK URGP=0
Oct 17 10:10:55 localhost [74701.670101] IPT: NEW not SYN (rejected): IN=eth0 OUT= MAC=00:0e:a6:80:c6:30:00:1b:11:76:6d:dc:08:00 SRC=85.100.195.189 DST=192.168.1.2 LEN=57 TOS=0x00 PREC=0x00 TTL=116 ID=36390 DF PROTO=TCP SPT=4246 DPT=6881 WINDOW=65535 RES=0x00 ACK PSH URGP=0
Oct 17 10:11:23 localhost [74714.258932] IPT: NEW not SYN (rejected): IN=eth0 OUT= MAC=00:0e:a6:80:c6:30:00:1b:11:76:6d:dc:08:00 SRC=88.87.81.130 DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=234 ID=49965 DF PROTO=TCP SPT=41231 DPT=6881 WINDOW=1024 RES=0x00 ACK URGP=0
Oct 17 10:11:26 localhost [74715.133896] IPT: NEW not SYN (rejected): IN=eth0 OUT= MAC=00:0e:a6:80:c6:30:00:1b:11:76:6d:dc:08:00 SRC=85.100.195.189 DST=192.168.1.2 LEN=66 TOS=0x00 PREC=0x00 TTL=116 ID=38923 DF PROTO=TCP SPT=4246 DPT=6881 WINDOW=65535 RES=0x00 ACK PSH URGP=0

i need a regex for this log-entry to filter failures... can you help me?
The main feature message begin with "IPT:"
and the need to "SRC="

‹ vsftpd regex in /var/log/secure file blockhosts (and sshd) headache... ›
Fri, 2008-10-17 21:02 — ac

here it is...

    "ipt-new-not-syn":
        r'^\w\w\w .?\d \d\d:\d\d:\d\d ([^[:\]]+) \[[\d\.]+\] IPT: NEW not SYN \(rejected\): IN=.* SRC={HOST_IP} DST=',

Note that it closely matches the beginning of the log line pretty tightly, so any change in the log message will need re-creating the regex. It is usually good to make tight regexs to avoid spammers injecting invalid messages and force blocking valid IP addresses.