Hi,
> gw.ocg-corp.com - - [12/May/2002:20:29:08 -0400] "GET / HTTP/1.0" 200 18141 "-" "Opera/6.01 larbin2.6.2at_private"
> gw.ocg-corp.com - - [12/May/2002:20:31:04 -0400] "GET / HTTP/1.0" 200 18141 "-" "WinampMPEG/2.00 larbinat_private"
it's usually much better to use the IP-address in logfiles as the
reverse-lookup can
1.) be spoofed (as this seems to be the case) when the
logfile-writing program does not perform the
secure 2-way lookups (ip->name, name->ips, ip is in ips)
2.) change over time. Usually the netblock-ownership is more
persistent.
(for apache: Set HostNameLookups to off which is the recommended
setting anyway, setting it to "double" will do the 2-way lookup)
Chris
--
With whispering winds / Our Martian future awaits / Like buds under snow
-- adrianhon on the kuro5hin.org Textad Haiku Contest
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon May 13 2002 - 15:33:27 PDT