A Good Question about log

A Good Question about log

[Blesson Paul]

[-- Attachment #1: Type: text/plain, Size: 917 bytes --]

hi all
We are maintaining a Linux Sever as the gateway and we are using IP Tables 
for Nating and routing. It is working perfectly. Now the question is about 
the log it is displaying. There are lots of packets from the internet which 
are get "DROPED". Presently the information in the log contains the src 
address(address somewhere in the internet), the destination address(always 
the IP of the Linux Server) , ports etc. I need to know more information 
about the droped packets. The important information I need to know to which 
computer in the intranet the src is intended to sent. I also like to know 
the internal table which contains the NAT information.
regards
Blesson Paul


Blesson Paul,
Software Engineer,
Integrated Computing Environments Ltd,
Cochin Special Economic Zone,
Cochin - 682 030, India.
Tel: +91-94473 70103(M)
       +91-484-2413 083(O),  +91-484-2413 096(O)
       +91-481-2380 893(R)


[-- Attachment #2: Type: text/plain, Size: 166 bytes --]


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

Re: A Good Question about log

[Allan Kissack]

From: "Blesson Paul" <blessonpaul@softhome.net>
To: <netfilter@lists.netfilter.org>
Sent: Monday, June 02, 2003 6:01 AM
Subject: A Good Question about log


<snip>
I need to know more information
> about the droped packets. The important information I need to know to
which
> computer in the intranet the src is intended to sent. I also like to know
> the internal table which contains the NAT information.
> regards
> Blesson Paul
>
>
> Blesson Paul,

Paul,

do you mean "iptables -t nat -L" ?
http://www.arin.net/whois/
http://www.ripe.net/perl/whois
http://www.apnic.net/apnic-bin/whois.pl
http://www.nic.ad.jp/cgi-bin/whois_gw
These urls should help find some information on the source ip's

--
Allan

Re: A Good Question about log

[Blesson Paul]

[-- Attachment #1: Type: text/plain, Size: 1267 bytes --]

No  I need to know the address translation table. I need to display it
At 07:24 AM 6/2/03 +0000, Allan Kissack wrote:

>From: "Blesson Paul" <blessonpaul@softhome.net>
>To: <netfilter@lists.netfilter.org>
>Sent: Monday, June 02, 2003 6:01 AM
>Subject: A Good Question about log
>
>
><snip>
>I need to know more information
> > about the droped packets. The important information I need to know to
>which
> > computer in the intranet the src is intended to sent. I also like to know
> > the internal table which contains the NAT information.
> > regards
> > Blesson Paul
> >
> >
> > Blesson Paul,
>
>Paul,
>
>do you mean "iptables -t nat -L" ?
>http://www.arin.net/whois/
>http://www.ripe.net/perl/whois
>http://www.apnic.net/apnic-bin/whois.pl
>http://www.nic.ad.jp/cgi-bin/whois_gw
>These urls should help find some information on the source ip's
>
>--
>Allan
>
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

Blesson Paul,
Software Engineer,
Integrated Computing Environments Ltd,
Cochin Special Economic Zone,
Cochin - 682 030, India.
Tel: +91-94473 70103(M)
       +91-484-2413 083(O),  +91-484-2413 096(O)
       +91-481-2380 893(R)


[-- Attachment #2: Type: text/plain, Size: 166 bytes --]


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

RE: A Good Question about log

[George Vieira]

That does display it. I think you need to be more specific or give some simple example of what kind of output do you want or expect so we know what you need..

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au



-----Original Message-----
From: Blesson Paul [mailto:blessonpaul@softhome.net]
Sent: Tuesday, June 03, 2003 6:47 PM
To: Allan Kissack; netfilter@lists.netfilter.org
Subject: Re: A Good Question about log


No  I need to know the address translation table. I need to display it
At 07:24 AM 6/2/03 +0000, Allan Kissack wrote:

>From: "Blesson Paul" <blessonpaul@softhome.net>
>To: <netfilter@lists.netfilter.org>
>Sent: Monday, June 02, 2003 6:01 AM
>Subject: A Good Question about log
>
>
><snip>
>I need to know more information
> > about the droped packets. The important information I need to know to
>which
> > computer in the intranet the src is intended to sent. I also like to know
> > the internal table which contains the NAT information.
> > regards
> > Blesson Paul
> >
> >
> > Blesson Paul,
>
>Paul,
>
>do you mean "iptables -t nat -L" ?
>http://www.arin.net/whois/
>http://www.ripe.net/perl/whois
>http://www.apnic.net/apnic-bin/whois.pl
>http://www.nic.ad.jp/cgi-bin/whois_gw
>These urls should help find some information on the source ip's
>
>--
>Allan
>
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

Blesson Paul,
Software Engineer,
Integrated Computing Environments Ltd,
Cochin Special Economic Zone,
Cochin - 682 030, India.
Tel: +91-94473 70103(M)
       +91-484-2413 083(O),  +91-484-2413 096(O)
       +91-481-2380 893(R)

RE: A Good Question about log

[wayne]

What about

   cat /proc/net/ip_conntrack

Does that help?

: -----Original Message-----
: From: netfilter-admin@lists.netfilter.org 
: [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
: George Vieira
: Sent: 03 June 2003 23:25
: To: Blesson Paul; Allan Kissack; netfilter@lists.netfilter.org
: Subject: RE: A Good Question about log
: 
: 
: That does display it. I think you need to be more specific or 
: give some simple example of what kind of output do you want 
: or expect so we know what you need..
: 
: Thanks,
: ____________________________________________
: George Vieira
: Systems Manager
: georgev@citadelcomputer.com.au
: 
: Citadel Computer Systems Pty Ltd http://www.citadelcomputer.com.au
: 
: 
: 
: -----Original Message-----
: From: Blesson Paul [mailto:blessonpaul@softhome.net]
: Sent: Tuesday, June 03, 2003 6:47 PM
: To: Allan Kissack; netfilter@lists.netfilter.org
: Subject: Re: A Good Question about log
: 
: 
: No  I need to know the address translation table. I need to 
: display it At 07:24 AM 6/2/03 +0000, Allan Kissack wrote:
: 
: >From: "Blesson Paul" <blessonpaul@softhome.net>
: >To: <netfilter@lists.netfilter.org>
: >Sent: Monday, June 02, 2003 6:01 AM
: >Subject: A Good Question about log
: >
: >
: ><snip>
: >I need to know more information
: > > about the droped packets. The important information I 
: need to know 
: > > to
: >which
: > > computer in the intranet the src is intended to sent. I 
: also like to 
: > > know the internal table which contains the NAT 
: information. regards
: > > Blesson Paul
: > >
: > >
: > > Blesson Paul,
: >
: >Paul,
: >
: >do you mean "iptables -t nat -L" ?
: >http://www.arin.net/whois/
: >http://www.ripe.net/perl/whois 
: http://www.apnic.net/apnic-bin/whois.pl
: 
>http://www.nic.ad.jp/cgi-bin/whois_gw
>These urls should help find some information on the source ip's
>
>--
>Allan
>
>
>
>
>---
>Incoming mail is certified Virus Free.
>Checked by AVG anti-virus system (http://www.grisoft.com).
>Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

Blesson Paul,
Software Engineer,
Integrated Computing Environments Ltd,
Cochin Special Economic Zone,
Cochin - 682 030, India.
Tel: +91-94473 70103(M)
       +91-484-2413 083(O),  +91-484-2413 096(O)
       +91-481-2380 893(R)