On 11/06/07 10:38, Jonathan Gazeley wrote:
Yes that's correct. Per connection is fine; we just need to know which users were talking to what, when. Logging every packet simply isn't feasible (or useful) on a network that shifts 38TB every single day!
That's a LOT of traffic and will equally be a LOT of logs.
Yes, knowing when the connection terminates is also useful, otherwise we won't know how long a user is connected to a server for.
That may be more problematic to detect, especially with UDP. For TCP streams that shut down normally, you could watch for the FIN packets and log them. However I'm not sure how to detect the non continuance of a UDP stream, much less other protocols. The only thing that I can think of is to watch for the lack of traffic for a specific amount of time and presume that the connection is terminated.
I suppose you could augment the connection tracking code to log when it expired a tracked connection. You could at least get the end of a connection this way. However this is probably kernel coding.
I'll let you know how this goes, although this isn't my highest priority project at the moment so I may not get a chance to play for a few days.
Please do, I'm interested to know fore future projects.
Thanks a lot for your help.
You are welcome. Grant. . . . - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
