Hi,
i want to log ARP headers, thus i create arp family table
with one chain with only one rule, somethong as:
arp operation request limit ... countef log group 2 prefix ...
It basically works, counter grows and packets are logged
via ulogd2 stack::
stack=log2a:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,gp1:GPRINT
Except that the log entries has not any ARP headers.
Then i found this article [1], which mentions the ARP as
sysctlt key:
net.netfilter.nf_log.3
Thus i set it to "nfnetlink_log", but that doesn't help. It
is hard to find what these numbers are, but i guess that
family constants, as 2, 7 and 10 (from ulogd2 start log)
coresponds to inet, inet6 and bridge family, but i am not
aware of arp family...
I guess that ulogd2 is able to log ARP headers as i found
them in BASE plugin's info output, but please what i have
to do to get them into log? Or problem is, that i play with
it inside LXC container (other logging works in it)?
regards
[1] <https://fedoramagazine.org/network-address-translation-part-4-conntrack-troubleshooting/
--
Slavko
https://www.slavino.sk/
