v0.9.4 (06-Jan-2009) [+] compatible with openVZ/Virtuozzo containers. The daemon will run in 'light mode', without attempting to modify the TCP/IP stack. [+] added /proc/net/tcp6 monitoring. [+] server IPs are whitelisted at startup. [+] better handling of the connection tracking table by adding CONNTRACK_MAX and CONNTRACK_HASHSIZE variables. [+] added NO_CONNTRACK variable to floodmon.conf. [!] lowered MAX_SYN and NULLROUTE_SUBNET variable default values. [-] the daemon does NOT use iptables any more (pretty much useless). [-] removed 'martian blocks' (pretty much useless too). [+] check for floomon updates (optional). [+] improved performances in the main loop by replacing inet_ntoa() with hex() function for little-endian/decimal IPs conversion. ====================================================================== v0.9.3 (25-June-2009) [+] added '--capture' option for on-demand capture of SYN packets. Capture can be saved to disk or sent by email. [-] fixed NETMASK bug. [+] munin-node stats modification : they now display the current amount of half-open connections (SYN_RECV) per level. [+] added new iptables rules (invalid flags). [+] either nf_* or ipt_* keys will be used for the connection tracking table. ====================================================================== v0.9.2 (15-May-2009) [+] increased performances (15 to 20%). [+] a SYN packets capture can be sent by email for analysis. [+] reject 'martian' IP's. [+] possibility to receive a SMS alert. [+] detailed report sent by email during an attack. [+] better handling of alert levels. [+] fork while sending alerts/reports (email and SMS) [+] most variables can now be setup in the configuration file (/etc/floodmon.conf). ====================================================================== EOF