Jason Opperisano wrote: >>AFAIK, the normal LOG target cannot actually do this. instead, use the ULOG target which will copy the entire packet to the >>userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump file of the packets you are >>interested in. I also would like to log the packet data. In fact, I would like to monitor NFS Write calls. However, using ULOG and copying all packets to user space is time consuming. I have no interest in Read calls which is most of the traffic. Does iptables provide a tool to filtering packets by looking at the data ? Thanks, Israel -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Jason Opperisano Sent: Wednesday, November 24, 2004 12:12 AM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: Logging the whole packet On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote: > Is it possible to log the packet body and not just the header? > > Currently I have this line in my iptables start-up file: > > /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79 > -j > LOG --log-prefix="Packet_Filter:" > > And it generates log entries such as this: > > Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= > MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 > DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF > PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0 > > I'd like to capture the packet body as well. I'm new to packet logging > so forgive me if I'm over looking the obvious. AFAIK, the normal LOG target cannot actually do this. instead, use the ULOG target which will copy the entire packet to the userspace ulogd daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump file of the packets you are interested in. check out: http://gnumonks.org/gnumonks/projects/project_details?p_id=1 for more details about ulogd. HTH... -j -- "Television! Teacher, mother, secret lover." --The Simpsons
