On Sun, 2007-01-21 at 09:37 -0500, Jeffrey Ross wrote: > When logwatch reports that a host probed the server, what information > does it use to determine that? I tried to grep for the IP address > that did the probing in /var/log/* and came up empty handed. I've only seen that when the webserver has been accessed by a non-LAN address. I haven't looked into what it considers to be an external address, I presume it's using the netmask. e.g. If a server's at 192.168.1.6 with a netmask of 255.255.255.0, then anything from 192.168.1.0 to 192.168.1.255 is on the LAN, anything else is considered external. Do you run a webserver? Is it accessible externally? Do you want it to be? -- (Currently running FC4, in case that's important to the thread) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
