Jozsef Kadlecsik wrote:
On Tue, 21 Apr 2009, Patrick McHardy wrote:
I can see that it has some informational value, but for things like
locating infected hosts, why not simply look at the traffic before
it is NATed? I currently can't come up with a real use case for
this ...
The well-maintained sites manage to locate on-site infected machines by
using IDS, traffic-analysis, etc. However the typical user case for small
sites is that the ISP or other offsite host report an abuse: "your machine
x.y.z.w attacked machine a.b.c.d/added to the RBL because of spamming/etc"
- and the machine x.y.z.w is of course their firewall. And they have got
nothing which could help them to pick the real machine from the NATed
network behind the firewall. And the small sites is the main reason why
I'd favor an "out of the box" solution, which does not rely on anything
besides netfilter/iptables.
Yes, but at that point, you can look at your logfiles and see who
connected to a.b.c.d and you'll see the internal address. Logging
the NATed address is not really helping since you need the internal
address anyways, so it seems natural to look at the unNATed information.
What am I missing here?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
