tripwire

Tripwire

A nice usefull tool to create iptable-rules which logs all connections to a given port to detect ip-scanner and hacker. You can use it in combination with the ScanBanServer and Triplink to create a network to collect and block internet scanner

Install

Run

go get
go build -o tripwire

it was tested with go 1.13. If compiling doesn't work, try using go1.13

Usage

Show help
#./tripwire -h

Create a rule to log and allow all connections to port 21 and write them into /var/log/ftpListener.conf
#./tripwire add -p21 -o ftpListener -a

...Block incomming connections (instead of accepting them)
#./tripwire add -p21 -o ftpListener

...Specifies the loglevel
#./tripwire add -p21 -o ftpListener -l5

Delete log and iptable rules for port 21
#./tripwire delete -p21 -o ftpListener

List all tripwire configurations
#./tripwire list