Re: iptables NAT logging

[Grant Taylor <gtaylor@riverviewtech.net>]

On 11/06/07 10:38, Jonathan Gazeley wrote:
> Yes that's correct. Per connection is fine; we just need to know which 
> users were talking to what, when. Logging every packet simply isn't 
> feasible (or useful) on a network that shifts 38TB every single day!

That's a LOT of traffic and will equally be a LOT of logs.

> Yes, knowing when the connection terminates is also useful, otherwise we 
> won't know how long a user is connected to a server for.

That may be more problematic to detect, especially with UDP.  For TCP 
streams that shut down normally, you could watch for the FIN packets and 
log them.  However I'm not sure how to detect the non continuance of a 
UDP stream, much less other protocols.  The only thing that I can think 
of is to watch for the lack of traffic for a specific amount of time and 
presume that the connection is terminated.

I suppose you could augment the connection tracking code to log when it 
expired a tracked connection.  You could at least get the end of a 
connection this way.  However this is probably kernel coding.

> I'll let you know how this goes, although this isn't my highest priority 
> project at the moment so I may not get a chance to play for a few days.

Please do, I'm interested to know fore future projects.

> Thanks a lot for your help.

You are welcome.



Grant. . . .