Re: Follow packets in rules

[Patrick McHardy <kaber@trash.net>]

Simon wrote:
>> I know this possibility and I use it for log some packets but I can't
>> double
>> all my rules (almost 200) by a log rule.
> 
> 
> Hi Fabrice,
>  I don't log everything too.  I usually choose some types of
> information to log, and some IP's to log from.  For example, a friend
> connected to my pc and logged in to a secure website, at that moment,
> i stop logging this guy, the website logs in its own way.  Somebody
> that is still trying stuff and has not yet connected for X minutes
> will then get flagged as a suspect and different logging takes place
> (to avoid DoS, and others).
> 
>  One last detail, is if your rules are done well, you don't need to
> log much.  Logging more would be for "debuging" or "development" in my
> opinion.  So when I was suggesting to have a log identify each rules
> passed by each packets it wasn't for a production environment.  But
> then again, if you asked this kind of question, i hope it wasn't for a
> prod system!
> 
>  As for testing the rules, I think the best way is to craft packets
> and send them to the interface.  There are some hacking tools that
> permit to make raw ethernet frames and provide "easy" way of modifying
> packets at the ip or tcp level and they work like scripts that you
> execute.


Just FYI, Jozsef sent a patch to merge TRACE into mainline today, I'll
most likely send it upstream for 2.6.23.