Re: [ossec-list] Detecting Internet Access

[Florian Crouzat]

Le 17/02/2012 17:13, Mike Disley a écrit :

<localfile>
     <log_format>command</log_format>
     <command>netstat -an | findstr ":80 :443 " | findstr TCP</command>
</localfile>

Just found out about Window's grep: findstr.
I tried your pipeline on one of my server, your pattern will have 
false-positive if you are binding on port :800, or :4432, etc.

Here's what I did:
netstat -an | findstr ":80\> :443\>" | findstr TCP

--
Cheers,
Florian Crouzat