ѽ҉ᶬḳ℠ <vtol@xxxxxxx> wrote:
> Having perused the WIKI [1] I tried to get protocol specific logging going,
> but ended up with
>
> * tcp log -> Error: syntax error, unexpected log
> * icmpv6 log -> Error: syntax error, unexpected log
>
> Only with an explicit protocol statement logging works
>
> * ip protocol tcp log
> * ip6 nexthdr icmpv6 log
You mean "log" doesn't work? (no "tcp" prefix).
> cat /proc/net/netfilter/nf_log
> 0 NONE (nfnetlink_log)
> 1 NONE (nfnetlink_log)
> 2 nf_log_ipv4 (nf_log_ipv4,nfnetlink_log)
> 3 NONE (nfnetlink_log)
> 4 NONE (nfnetlink_log)
> 5 NONE (nfnetlink_log)
> 6 NONE (nfnetlink_log)
> 7 NONE (nfnetlink_log)
> 8 NONE (nfnetlink_log)
> 9 NONE (nfnetlink_log)
> 10 nf_log_ipv6 (nf_log_ipv6,nfnetlink_log)
> 11 NONE (nfnetlink_log)
> 12 NONE (nfnetlink_log)
This means that ipv4 is logged by nf_log_ipv4 and ipv6 via
nf_log_ipv6. Everything should be working for ipv4, ipv6 and inet
without any further action (provided you want to use printk-based
logging via dmesg rather than nfnetlink).
> Tried with
>
> echo "nf_log_icmp" > /proc/sys/net/netfilter/nf_log/1
There is no layer 4 logger. nf_log_XXX, where XXX is a l3 protocol
family, i.e. nf_log_{ipv4,ipv6,arp,bridge} or nfnetlink_log.
