We had a firewall application using an old OpenBSD (2.9). One of the things it did on NAT was log lines like this when connections closed:
Apr 29 23:25:46 si000AmerSh ipmon[3122]: 23:25:46.021102 STATE:CLOSE 216.65.19.55,53505 -> 192.168.0.82,25 PR tcp Pkts 60 Bytes 22144
We used this line to do statistics.
I'm trying to figure out how to get something similar with Netfilter.
Basically, what I need is a report of the connection: where it was to, how many bytes and packets it had, when it closes.
I've looked at ulogd, but I'm not sure that would be ideal. Basically, I'd have to build my own connection tracker DB to assign every packet to, so I'd be at least doubling the memory footprint.
I'm wondering if there's something built in that I can get to to give me these kinds of statistics. Or if I should be writing an extension. (I'd like to get this data for every connection that goes through the firewall.)
Thoughts, or pointers? I'm looking for input before I waste too much time barking up the wrong tree.
Thanks,
Kevin
