Jason Opperisano wrote:
On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:Thanks, that works great. I had to recompile the kernel to get ULOG support, but other than that, it's rather straightforward. I added this line to my iptables startup script:
Is it possible to log the packet body and not just the header?
Currently I have this line in my iptables start-up file:
/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79 -j LOG --log-prefix="Packet_Filter:"
And it generates log entries such as this:
Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
I'd like to capture the packet body as well. I'm new to packet logging so forgive me if I'm over looking the obvious.
AFAIK, the normal LOG target cannot actually do this. instead, use the ULOG target which will copy the entire packet to the userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump file of the packets you are interested in. check out:
http://gnumonks.org/gnumonks/projects/project_details?p_id=1
for more details about ulogd.
HTH...
-j
-- "Television! Teacher, mother, secret lover." --The Simpsons
/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79 -j ULOG --ulog-prefix "Packet_Filter:"
I'm using the /usr/lib/ulogd/ulogd_OPRINT.so plugin to write the packet capture to a file for now. Here's a sample of what it looks like:
===>PACKET BOUNDARY tcp.fin=0 tcp.syn=1 tcp.rst=0 tcp.psh=0 tcp.ack=0 tcp.urg=0 tcp.window=64240 tcp.ackseq=0 tcp.seq=4245420361 tcp.dport=445 tcp.sport=2797 ip.fragoff=16384 ip.id=11011 ip.csum=2618 ip.ihl=5 ip.totlen=48 ip.ttl=111 ip.tos=0 ip.protocol=6 ip.daddr=128.173.120.79 ip.saddr=63.231.157.167 oob.out= oob.in=eth0 oob.mark=0 oob.time.usec=213408 oob.time.sec=1101257132 oob.prefix=Packet_Filter: raw.pktlen=48 raw.pkt=raw.mac=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00
Now, all I need to do is figure out what's in the packet body. Any pointers on that? Ideally I'd like to write a script that recreates keystrokes from packets that contain ssh session info. Probably off-topic here, but I thought I'd ask. Thanks for the ULOG tip!
