I sent this message on Monday (by mistake, it was sent twice). I've not seen a response, and I'm not sure where to go next. I'm considering asking in -dev, because I'm willing to do some coding, I just want to make sure I'm looking in the right direction.
Please help me with any thoughts you can provide, so I go about solving this the right way! Thanks!
We had a firewall application using an old OpenBSD (2.9). One of the things it did on NAT was log lines like this when connections closed:
Apr 29 23:25:46 si000AmerSh ipmon[3122]: 23:25:46.021102 STATE:CLOSE 216.65.19.55,53505 -> 192.168.0.82,25 PR tcp Pkts 60 Bytes 22144
We used this line to do statistics.
I'm trying to figure out how to get something similar with Netfilter.
Basically, what I need is a report of the connection: where it was to, how many bytes and packets it had, when it closes.
I've looked at ulogd, but I'm not sure that would be ideal. Basically, I'd have to build my own connection tracker DB to assign every packet to, so I'd be at least doubling the memory footprint.
I'm wondering if there's something built in that I can get to to give me these kinds of statistics. Or if I should be writing an extension. (I'd like to get this data for every connection that goes through the firewall.)
Thoughts, or pointers? I'm looking for input before I waste too much time barking up the wrong tree.
Thanks,
Kevin
