iplog 2.2.1 by Ryan McCabe <odin@numb.org>
------------------------------------------

iplog is a TCP/IP traffic logger.  Currently, it is capable of logging 
TCP, UDP and ICMP traffic.  Adding support for other protocols
should be relatively easy.

iplog 2.x is complete rewrite of iplog 1.x, which was written by behe
<eric@ojnk.net>.  As such, it contains all the features supported by
iplog 1.x, including a built-in DNS cache, the ability to detect port
scans, null scans, and FIN scans, "smurf" attacks, and bogus TCP flags
(used by scanners to detect the operating system in use).  iplog 2.x
adds detection of "Xmas" scans, ICMP ping floods, UDP scans, and IP
fragment attacks.

iplog 2.2 adds a configuration file.  See the iplog.conf(5) manual page
and the "example-iplog.conf" file for details on using the configuration
file.  Put "iplog --help" for a full listing of command-line options.
The iplog(8) manual page describes each of these options in detail.

iplog 2.x uses libpcap to read data from the network, making it much more
portable than iplog 1.x, which ran exclusively on Linux.  iplog currently
runs on FreeBSD (tested on 3.x and 4.0), OpenBSD (only works
correctly with version 2.6 and beyond), BSDI (tested on 4.0 and 4.01) and
Solaris (tested on Sparc Solaris 7 and Sparc Solaris 2.5.1).
iplog can be ported to any system that supports pthreads and on which
libpcap will function. 

iplog 2.1 is able to run in promiscuous mode and monitor traffic to all
hosts on a network.  This capability should be considered unstable and
requires testing.


GETTING IPLOG
-------------

The primary distribution site for iplog is http://ojnk.sourceforge.net

Mirrors:

USA:    ftp://ojnk.sourceforge.net/pub/ojnk/iplog
USA:    http://www.numb.org/~odin


OTHER
-----

Please note that iplog will not build with BSD make.  GNU make must be
used.  It is available from any GNU mirror.  Please do not send me email
about iplog not building on BSD if you're not using GNU make.

libpcap can be retrieved from http://www.tcpdump.org

If you compile libpcap yourself, remember to put
"mkdir /usr/local/include/net ; make install-incl"  "make install" alone will
not install the pcap header files.

The linuxthreads library (for Linux libc5) can be found at 
ftp://ftp.inria.fr/INRIA/Projects/cristal/Xavier.Leroy/linuxthreads.tar.gz

GNU make can be found at ftp.gnu.org:/pub/gnu/make

Any contributions (testing, comments, bug reports, ports, enhancements,
etc) are greatly appreciated.











$Id: README,v 1.16 2000/07/04 01:22:19 odin Exp $
