Re: Logging the whole packet

[Jason Opperisano <opie@817west.com>]

On Tue, Nov 23, 2004 at 04:50:28PM -0500, Brad Tilley wrote:
> Is it possible to log the packet body and not just the header?
> 
> Currently I have this line in my iptables start-up file:
> 
> /sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  -j 
> LOG --log-prefix="Packet_Filter:"
> 
> And it generates log entries such as this:
> 
> Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
> MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
> DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
> PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
> 
> I'd like to capture the packet body as well. I'm new to packet logging 
> so forgive me if I'm over looking the obvious.

AFAIK, the normal LOG target cannot actually do this.  instead, use the
ULOG target which will copy the entire packet to the userspace ulogd
daemon where you can use the ulogd_PCAP.so plugin to create a tcpdump
file of the packets you are interested in.  check out:

  http://gnumonks.org/gnumonks/projects/project_details?p_id=1

for more details about ulogd.

HTH...

-j

--
"Television! Teacher, mother, secret lover."
        --The Simpsons