xtables monitoring via NETLINK (or similar)

xtables monitoring via NETLINK (or similar)

[epankala]

I have been looking into how kernel supplies userspace with what is
happening inside kernel via NETLINK socket and how udevd->hald->dbus->user
benefits from it.
(NETLINK_ROUTE protocol reports for example interface up/down events
and KOBJECT report device add/remove && insmod/rmmod events)


I was wondering is there a way to monitor iptables (xtables)
replace_table/(un)register_target/...  events somehow.
(could not see it in kernel code but that doesn't mean it's not there.
NETLINK_FIREWALL seems to be about queuing packets to userspace)

Main incentive for me is that it would be better to listen for a socket 
than
poll for firewall changes manually.

If such does not exist would there be intrest to add such capability.
I could volunteer to do bit of design/implementation if such feature 
would be welcomed.

-- 
Janne (orshouldthisgotonetfilter-devel) Pänkälä