Richard Horton schreef:
Right, at this point you've lost me, how I will manage to do that, and where
does the infomation get stored?
You will need to turn trace on...
iptables -A PREROUTING -t raw -J TRACE will turn tracing on for everything.
The information is then stored in the syslog as per your syslog
configuration - TRACE will show which rules etc your packets have
encountered.
Ok got that since kern.log will get majorly flooded I grepped the output.
If needed I can attach the whole log?
cat kern.log | grep 81.4.97.
Nov 5 18:48:14 sakura kernel: [ 194.028498] fwmark 0x1: IN=eth1 OUT=
MAC=00:1b:21:2d:a9:fa:00:1b:21:32:99:5f:08:00 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0 MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028527] TRACE:
mangle:PREROUTING:policy:3 IN=eth1 OUT=
MAC=00:1b:21:2d:a9:fa:00:1b:21:32:99:5f:08:00 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028570] TRACE:
mangle:FORWARD:policy:1 IN=eth1 OUT=eth0 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028598] TRACE:
filter:FORWARD:rule:1 IN=eth1 OUT=eth0 SRC=192.168.1.30 DST=81.4.97.160
LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP SPT=52436 DPT=80
SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT
(0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.028626] TRACE:
mangle:POSTROUTING:policy:1 IN= OUT=eth0 SRC=192.168.1.30
DST=81.4.97.160 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=13005 DF PROTO=TCP
SPT=52436 DPT=80 SEQ=2949910603 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0
OPT (0204116C01010402) MARK=0x1
Nov 5 18:48:14 sakura kernel: [ 194.149805] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:14 sakura kernel: [ 194.149861] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:15 sakura kernel: [ 195.173980] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:15 sakura kernel: [ 195.174046] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:27 sakura kernel: [ 207.173329] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:27 sakura kernel: [ 207.173394] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:52 sakura kernel: [ 231.380824] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:48:52 sakura kernel: [ 231.380891] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:49:40 sakura kernel: [ 279.579532] TRACE:
raw:PREROUTING:policy:2 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
Nov 5 18:49:40 sakura kernel: [ 279.579591] TRACE:
mangle:PREROUTING:policy:3 IN=eth0 OUT=
MAC=00:50:bf:65:b7:c1:00:18:39:27:fc:5a:08:00 SRC=81.4.97.160
DST=192.168.2.40 LEN=48 TOS=0x00 PREC=0x00 TTL=58 ID=0 DF PROTO=TCP
SPT=80 DPT=52436 SEQ=3690844742 ACK=2949910604 WINDOW=5840 RES=0x00 ACK
SYN URGP=0 OPT (020405B401010402)
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
