From: "Dâniel Fraga" <fragabr@gmail.com>
To: Patrick McHardy <kaber@trash.net>
Cc: netfilter-devel@vger.kernel.org,
"Pablo Neira Ayuso" <pablo@netfilter.org>,
"Ilpo Järvinen" <ilpo.jarvinen@helsinki.fi>
Subject: Re: Every other char with LOG netfilter output (bug?)
Date: Fri, 31 Oct 2008 00:01:57 -0200 [thread overview]
Message-ID: <490a671a.0687460a.3af5.40a2@mx.google.com> (raw)
In-Reply-To: <49095F02.7040104@trash.net>
[-- Attachment #1: Type: text/plain, Size: 1729 bytes --]
On Thu, 30 Oct 2008 08:15:14 +0100
Patrick McHardy <kaber@trash.net> wrote:
> One thing you need is to specify the amount of bytes you want transfered
> to userspace:
>
> iptables ... -j NFLOG --nflog-range 65535
Another one (now with --nflog-range 65535 as requested):
1) using LOG:
Oct 30 23:14:34 tux vmunix: :d0:87:60:0SC6.3.310DT121812LN4 O=x0PE=x0TL4 D0POOTPST8 P=94 IDW0RS00 C S RP0
Oct 30 23:14:34 tux vmunix: 6DO NU:I=t0OT A=01:3e:79:01:fe:b2:80 R=3267.9 S=9.6.. E=0TS00 RC00 T=4I= RT=C P=0DT585WNO= E=x0AKRTUG=
2) using NFLOG (syslog emul):
Oct 30 23:14:34 tux DROP INPUT: IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0
Oct 30 23:14:34 tux DROP INPUT: IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0
Oct 30 23:14:34 tux DROP INPUT: IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255566 WINDOW=0 ACK RST URGP=0 MARK=0
Oct 30 23:14:34 tux DROP INPUT: IN=eth0 OUT= MAC=00:18:f3:e4:47:9f:00:1d:0f:e8:7b:26:08:00 SRC=63.236.73.190 DST=192.168.1.2 LEN=40 TOS=00 PREC=0x00 TTL=44 ID=0 PROTO=TCP SPT=80 DPT=59845 SEQ=0 ACK=2739255567 WINDOW=0 ACK RST URGP=0 MARK=0
It's interesting to note that NFLOG always give the double of the entries of the "wrong" LOG entries.
3) and the attached pcap log file.
I hope that it will give you some hint. Thanks!
--
[-- Attachment #2: ulogd-final.pcap.bz2 --]
[-- Type: application/octet-stream, Size: 997 bytes --]
next prev parent reply other threads:[~2008-10-31 2:02 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-10-28 17:09 Every other char with LOG netfilter output (bug?) Dâniel Fraga
2008-10-28 17:40 ` Patrick McHardy
2008-10-28 17:57 ` Dâniel Fraga
2008-10-28 18:13 ` Patrick McHardy
2008-10-28 18:50 ` Jan Engelhardt
2008-10-28 18:53 ` Patrick McHardy
2008-10-28 19:16 ` Dâniel Fraga
2008-10-30 5:50 ` Dâniel Fraga
2008-10-30 7:15 ` Patrick McHardy
2008-10-30 15:02 ` Pablo Neira Ayuso
2008-10-30 23:23 ` Dâniel Fraga
2008-10-31 2:01 ` Dâniel Fraga [this message]
2008-11-03 12:42 ` Patrick McHardy
2008-11-03 15:41 ` Dâniel Fraga
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=490a671a.0687460a.3af5.40a2@mx.google.com \
--to=fragabr@gmail.com \
--cc=ilpo.jarvinen@helsinki.fi \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.