Program
-------
  SmurfLog v2.1 by Richard Steenbergen <humble@lightning.net>
  A program to assist in the logging of smurf attacks.


Purpose
-------
  This program is designed to log smurf attacks and the amplifier networks.
  Essentially, it is an ICMP Echo Reply logger with the following twists:
   - Logging only begins after passing a certain threshold rate of packets/sec
     and kilobytes/sec from incoming echo replies. This prevents the logging
     of innocent ping replies.
   - Only the /24 is logged, and it is only logged once per attack.

  Before this program, if you wanted to log the smurf broadcasts used during
  an attack, you had to either get to the machine being attacked and start
  an icmp logger, or run one continuously and pray that the smurf stopped
  before you ran out of HD space.

  During an average smurf attack, the log files can reach sizes of 800MB or
  more in 10 to 15 minutes. You must then go through the hastle of grep'ing,
  awk'ing, sort'ing, and uniq'ing the logs to determine which networks must
  be mailed. Not exactly a pleasant task, and not everone can get to the
  machine in time or leave an ICMP logger running.

  SmurfLog solves this problem by providing a simple, low-cpu usage system
  that records only unique /24's. It can safely be left running on any system
  and will (should) record only broadcasts used during a genuine smurf attack. 

  Of course you are required to use a little common sense. If you ping out
  while under attack and successfully receive a reply it will be included
  with the other ips, and of course don't be surprised if you end up with
  things like 10.0.0.0 0.0.0.0 255.255.255.255 etc, from others poorly
  configured networks (but you knew that already).


Platforms
---------
  This has been fully tested of FreeBSD, and compiles cleanly on Linux,
  OpenBSD, BSDI, and Solaris. Of course, its difficult to find people who
  are willing to run this and then piss off a packet kiddie, so the best
  of luck to you, and let me know if you have problems or suggestions.


How to use
----------
  Run ./configure
  Edit config.h, change the settings to suit your needs and your network.
  Run make

  Options:
    -h		  Display help
    -p		  Enable promisc mode for selected interface
    -i <iface>	  Select the interface to monitor
    -f <filename> Log to a selected file instead of syslog

  By default everything goes to stdout, so you'll most likely want to
  redirect that to a log file and background it.

  MD5 (smurflog.c) = c2439f95cde6b18ea4e127962d2aaf62
  MD5 (smurflog.h) = 02eab7814cac5950447b0737f9dc4d0f
  MD5 (hash.c)     = 585d0b1de4f72bcd4094a6ab0727df7f
  MD5 (hash.h)     = d356bb0e96f2277daf7ce1625ef03c82


Contact
-------
  IRC:   humble (EFnet)
  EMAIL: Richard Steenbergen <humble@lightning.net>
  WEB:   http://www.bitchx.com/~humble
