firewall logging

firewall logging

[Ľuboš Šoltés]

	Hi there

	I do have a question, or rather a problem.

	I need to get logs from a firewall (iptables) for every
	PC in the LAN. Something like 'source IP time/date destination
	IP/port packet size' Is something like this possible with
	iptables? I had a proxy running, but it was too slow, and
	I need to log EVERYTHING, not just www/ftp.

	thx for help

	Lubos Soltes

Re: firewall logging

[Jamie Harris]

You might want to look into Ulog, take a surf to http://www.gnumonks.org .
 But yeah - it is possible although have you considered exactly how much
data your going to end up storing?  I hope you have plenty of disk space!

Jamie...

> 	Hi there
>
> 	I do have a question, or rather a problem.
>
> 	I need to get logs from a firewall (iptables) for every
> 	PC in the LAN. Something like 'source IP time/date destination
> 	IP/port packet size' Is something like this possible with
> 	iptables? I had a proxy running, but it was too slow, and
> 	I need to log EVERYTHING, not just www/ftp.
>
> 	thx for help
>
> 	Lubos Soltes
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>


-- 
**  This message was transmitted on 100% recycled electrons **

Re: firewall logging

[Ľuboš Šoltés]

	thx for the tip ... no need for much space ... it will
	be flushed in regular intervals and compressed :-)
	packets in the same stream need to be logged just as
	one stream ...

	bye

	Lubos Soltes

On Fri, 6 Jun 2003 09:35:41 +0100 (BST)
"Jamie Harris" <jamie@jharris.homeip.net> wrote:

> You might want to look into Ulog, take a surf to http://www.gnumonks.org .
>  But yeah - it is possible although have you considered exactly how much
> data your going to end up storing?  I hope you have plenty of disk space!
> 
> Jamie...
> 
> > 	Hi there
> >
> > 	I do have a question, or rather a problem.
> >
> > 	I need to get logs from a firewall (iptables) for every
> > 	PC in the LAN. Something like 'source IP time/date destination
> > 	IP/port packet size' Is something like this possible with
> > 	iptables? I had a proxy running, but it was too slow, and
> > 	I need to log EVERYTHING, not just www/ftp.
> >
> > 	thx for help
> >
> > 	Lubos Soltes
> > -
> > To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >
> 
> 
> -- 
> **  This message was transmitted on 100% recycled electrons **
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: firewall logging

[Stephen Satchell]

At 10:08 AM 6/6/2003 +0200, =?ISO-8859-2?B?pXVib7kgqW9sdOlz?= wrote:
>         Hi there
>
>         I do have a question, or rather a problem.
>
>         I need to get logs from a firewall (iptables) for every
>         PC in the LAN. Something like 'source IP time/date destination
>         IP/port packet size' Is something like this possible with
>         iptables? I had a proxy running, but it was too slow, and
>         I need to log EVERYTHING, not just www/ftp.

I was in a similar situation not too long ago, and was looking at how to do 
just what you are talking about.  In refining the definition of the 
problem, the issue was to find out where each PC on a Intranet was 
going.  So, running IPTABLES on my firewall computer, I defined a rule that 
logged every outbound TCP SYN event, and then parsed /var/log/messages to 
build a table of IP addresses.  By concentrating on only the first packet 
of the TCP establishment chain, I was able to keep the volume of log 
entries down.  Later, I added the refinement of also capturing RST events, 
which allowed me to track attempts at hitting closed machines.

The direct benefit of the effort was locating computers running "phone 
home" software.  After all, when you have a slew of connections to the same 
computer at port 80 at 3 in the morning, something is afoot!


-- 
"People who seem to have had a new idea have often just stopped having an 
old idea." -- Dr. Edwin H. Land