On 11/6/2007 9:01 PM, Philip Craig wrote:
ulogd2 has support for listening to the events, although I haven't
tested it recently. Look for the flow logging options.
You could also use the 'conntrack' tool to monitor them, and pipe
that to a log file.
Interesting.
This is purely about connection tracking, not filtering, so you can't
match up these events with the filter rule that accepted it, unless
you encode that in the mark or something. It will only get events
for connections that are accepted by filtering though.
Unless I mis-understand the OP's desires, I don't think the shortcoming
(if it qualifies as that) of not being able to associate a NetLink event
with a given IPTables rule is all that big of a deal. I think the OP
just needed to log internal and external source and destination IP
addresses and ports and when the connection started and stopped, thus
knowing which IPTables rule is (IMHO) a non issue. I guess depending on
what someone was trying to do this could be an issue.
Grant. . . .
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
