Re: Every other char with LOG netfilter output (bug?)

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Dâniel Fraga wrote:
>> On Tue, 28 Oct 2008 19:13:33 +0100
>> Patrick McHardy <kaber@trash.net> wrote:
>>
>>> I'm not familiar with ftrace, but you could manually instrument it
>>> (net/ipv4/netfilter/ipt_LOG.c). I'd try nfnetlink_log first though.
>>
>>     Hi Patrick, I installed ulogd2 with all necessary stuff. The
>> normal log is working (with the default ulogd.conf), but how can I
>> configure it to log the full packets? If you can provide me a sample
>> configuration, I'll appreciate!
> 
> One thing you need is to specify the amount of bytes you want transfered
> to userspace:
> 
> iptables ... -j NFLOG --nflog-range 65535
> 
> The printpkt output plugin doesn't log the full packet, but I'm not
> sure how to configure the pcap plugin (or whether it works at all
> in ulogd2, which is still somewhere between alpha and beta).
> Pablo (CCed) might be able to help.

The plugin works fine here. Uncomment the following lines:

# plugin="/usr/lib/ulogd/ulogd_output_PCAP.so

# this is a stack for NFLOG packet-based logging to PCAP
# stack=log1:NFLOG,base1:BASE,pcap1:PCAP

And make sure you have the appropriate section:

[pcap1]
file="/var/log/ulogd.pcap"
sync=1

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html