I could remember this, but why should I? I have it on the blog.category.
I already wrote about the firewall in Solaris 9 called "SunScreen" here and here. Now a quick reminder for me and others who tend to forget the syntax of commands.
To display a list of all denied connections, the following chain of commands can be used:
ssadm log get | ssadm logdump -i - -t a logwhy 256This command results in a list of denied connection-attempts to the machine, provided the entry for denying contains
LOG SUMMARY or any other valid specifier for the LOG command. log get instructs ssadm to (no surprise here) getthe log. It is then piped to another incarnation of
ssadm which is instructed to read from standard in(
-i -), to convert the seconds stored with every entry to a meaningful time and date combo (-t a) and to filter the entries for a why-code of
256.BTW: One thing that seems to be really hard to remember for me is the way the numerous options of
ssadm are named in the man-pages, e.g. man ssadm-logdump. Who would have thought of that, a hyphen, outlawed in *NIX to prevent confusing the different shells. Hm.
