From: Italo Valcy <italo@dcc.ufba.br>
To: jengelh@medozas.de
Cc: netfilter@vger.kernel.org
Subject: Re: How to log NAT translations
Date: Mon, 20 Sep 2010 23:25:13 -0300 [thread overview]
Message-ID: <4C981789.3070004@dcc.ufba.br> (raw)
In-Reply-To: <alpine.LNX.2.01.1009141953580.23103@obet.zrqbmnf.qr>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Jan,
Em 14-09-2010 14:54, Jan Engelhardt escreveu:
> On Tuesday 2010-09-14 19:24, Italo Valcy wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi guys!
>>
>> I'm a newbie in this mainling list, so I'm sorry if this question was
>> already asked.
>>
>> I'd like to have more specific logging output of NAT translation in
>> iptables. Is there an way to logging of ORIGINAL_IP/ORIGINAL_PORT +
>> TRANSLATED_IP/TRANSLATED_PORT?
>
> conntrack -E
Thank you for the reply.
Actually, I wanna something more simple and specific than the command
above. Using 'conntrack -E', I still have to parse the package events
NEW, UPDATE and DESTROY if I wanna know the of a NAT, for example.
Furthermore, with 'conntrack -E', in my opinion, we have an important
overhead of the output (it's so many messages to write to stdout - or
even redirect to a file)...
My ideia is to write a NAT (or conntrack) helper (as a kernel module)
that monitors the DESTROY event of a DNAT and try to find out when was
the NEW event of the same connection (maybe we have this information in
some struct..); then we write a log message (like LOG target does) which
contains ip_src-orig/port_src-orig,
ip_src-translated/port_src-translated, ip_dst/port_dst, duration of the
NAT (a little bit similar to Cisco/Asa NAT logging..). What do you
think? Where can I find some documentation to read?
Thank you so much for any help!
- --
Saudações,
Italo Valcy :: http://wiki.dcc.ufba.br/~ItaloValcy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyYF4kACgkQfidLqjN6RNGBrgCdGeGdZe4jzY7cR9xM5zNqV/RJ
k20AnRl6VKzz31k2vSqgQmL5Tafm931s
=bUcw
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2010-09-21 2:25 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-14 17:24 How to log NAT translations Italo Valcy
2010-09-14 17:54 ` Jan Engelhardt
2010-09-21 2:25 ` Italo Valcy [this message]
2010-09-21 9:26 ` Jan Engelhardt
2010-09-21 9:45 ` Pablo Neira Ayuso
2010-09-21 10:22 ` Jozsef Kadlecsik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C981789.3070004@dcc.ufba.br \
--to=italo@dcc.ufba.br \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.