From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1QC81R-0005DL-I0 for garchives@archives.gentoo.org; Tue, 19 Apr 2011 10:19:05 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 221DD1C005; Tue, 19 Apr 2011 10:17:31 +0000 (UTC) Received: from svr-us4.tirtonadi.com (unknown [69.65.43.212]) by pigeon.gentoo.org (Postfix) with ESMTP id F22671C005 for ; Tue, 19 Apr 2011 10:17:30 +0000 (UTC) Received: from mail-iy0-f181.google.com ([209.85.210.181]) by svr-us4.tirtonadi.com with esmtpsa (TLSv1:RC4-SHA:128) (Exim 4.69) (envelope-from ) id 1QC7zw-0002uk-0A for gentoo-user@lists.gentoo.org; Tue, 19 Apr 2011 17:17:32 +0700 Received: by iyb26 with SMTP id 26so6839627iyb.40 for ; Tue, 19 Apr 2011 03:17:27 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Received: by 10.42.179.69 with SMTP id bp5mr7055519icb.144.1303208247747; Tue, 19 Apr 2011 03:17:27 -0700 (PDT) Received: by 10.42.240.72 with HTTP; Tue, 19 Apr 2011 03:17:27 -0700 (PDT) In-Reply-To: <878vv69asl.fsf@newsguy.com> References: <878vv69asl.fsf@newsguy.com> Date: Tue, 19 Apr 2011 17:17:27 +0700 Message-ID: Subject: Re: [gentoo-user] [OT router advice] a router capable of detailed logs From: Pandu Poluan To: gentoo-user@lists.gentoo.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - svr-us4.tirtonadi.com X-AntiAbuse: Original Domain - lists.gentoo.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - poluan.info X-Archives-Salt: X-Archives-Hash: dce30b1c156c21de3b0a324bdc928bb5 On Tue, Apr 19, 2011 at 10:31, Harry Putnam wrote: > This is way OT, but this list is such a great resource I suspect the > advice gotten here will be more to the point. ( I have posted to a > network hardware group as well) > > I've bumped my home lan router to a gigabit from the old 10/100 > (NETGEAR FVS318). > > I made the move for the gigabit lan ports mainly. =C2=A0That is, I was > happy with other aspects of the old router. =C2=A0I ended up with a cisco > RVS4000 v2. > > The cisco solved the gigabit problem with 4 lan ports and even a > gigabit on the Internet port... (which is probably not really doing > any thing on a cable connection). =C2=A0And it wasn't hideously > expensive ($112.91). > > I could have solved the problem with gigabit switches behind the > router for lan usage, just as well, and may go to that yet, and move > back to the old NETGEAR router. =C2=A0But somehow I expected the cisco to > be something that was `excitingly' new and fun to play with. > > I'm disappointed in the cisco so far as logging is concerned. > > The logs give only bare information like this: > > Mar 10 10:24:21 =C2=A0- [Firewall Log-PORT SCAN] TCP Packet - 60.173.11.5= 6 --> 98.217.231.32 > Mar 10 10:24:21 =C2=A0- [Firewall Log-PORT SCAN] TCP Packet - 60.173.11.5= 6 --> 98.217.231.32 > [...] > > No mention of which port is involved. =C2=A0Not only on port scans but > ports are never reported. =C2=A0And of course if you wanted to pursue any > of it by way of google, you'd need the port number. > > The Old Netgear sent logs like this (wrapped for mail): > > =C2=A0Sat, 2007-07-28 12:00:11 - TCP packet - Source: 161.170.244.20 - > =C2=A0Destination: 70.131.83.195 - [Invalid sequence number received with > =C2=A0 Reset, dropping packet Src 443 Dst 1385 from WAN] > > ------- =C2=A0 =C2=A0 =C2=A0 =C2=A0--------- =C2=A0 =C2=A0 =C2=A0 ---=3D-= -- =C2=A0 =C2=A0 =C2=A0 --------- =C2=A0 =C2=A0 =C2=A0-------- > > I went for the cisco instead of a newer `gigabit' NETGEAR after seeing > several bad reviews about them. =C2=A0And I just assumed the cisco would > have as good or better other features. > > Another little problem is that the Cicso had reached its end of life > and was reported as such by cisco, well before I bought it. =C2=A0But of > course, retailers (not cisco) don't bother to give that kind of info, > but the result is that a kind of blackball list that was part of the > deal is no longer kept up to date. > > So, cutting to the chase; can anyone recommend from actual use, a home > lan router that has gigabit lan ports and very configurable/ > informative logging options? > > ps - I'm not interested in running an old linux or openbsd, machine as > router. =C2=A0Having a silent cool router the size and weight of a medium > book is too appealing. > Have you checked out Mikrotik's RB750G? 5 GbE ports: http://routerboard.com/pricelist/download_file.php?file_id=3D256 Mikrotik OS is Linux-based, the firewall is Netfilter-based, and it's Lua-scriptable. Rgds, -- Pandu E Poluan ~ IT Optimizer ~ Visit my Blog: http://pepoluan.posterous.com