log all dropped packets

log all dropped packets

[SB CH]

Hello, all.

my two questions are similar.

Question1. 
I would like to log all Dropped packet.
How can I write a log about all dropped packet?


Question2.
Surely, my default policy is DROP.
and one can't log about related default Policy.
How can I log packet information about default policy related? 


Thanks in advance.



_________________________________________________________________
보다 빠르고 보기 편한 뉴스. 오늘의 화제는 MSN 뉴스에서 확인하세요. 
http://www.msn.co.kr/news/

Re: log all dropped packets

[Darrell A. Escola]

On Wed, Oct 02, 2002 at 01:18:59AM +0000, SB CH wrote:
> Hello, all.
> 
> Question1. 
> I would like to log all Dropped packet.
> How can I write a log about all dropped packet?
> 
> Question2.
> Surely, my default policy is DROP.
> and one can't log about related default Policy.
> How can I log packet information about default policy related? 
> 
Just add a -j LOG rule before each DROP rule, or as the last rule in a chain
with a policy of DROP.

-- 
Darrell A. Escola, CCNA(R)
Cisco(R) Certified Network Associate

RE: log all dropped packets

[Stewart Thompson]

Hi:

	Try something like this at the end of each set of Rules.

$IPTABLES - INPUT -j LOG --log-level info  --log-prefix "FW INPUT  "
$IPTABLES - INPUT -j DROP
	Do the same for Forward and Output.

These rules should log all the dropped packets before they hit your
Drop Policy I believe. Hope that helps.

Stu........

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of SB CH
Sent: October 1, 2002 6:19 PM
To: netfilter@lists.netfilter.org
Subject: log all dropped packets

Hello, all.

my two questions are similar.

Question1.
I would like to log all Dropped packet.
How can I write a log about all dropped packet?


Question2.
Surely, my default policy is DROP.
and one can't log about related default Policy.
How can I log packet information about default policy related?


Thanks in advance.



_________________________________________________________________
보다 빠르고 보기 편한 뉴스. 오늘의 화제는 MSN 뉴스에서 확인하세요.
http://www.msn.co.kr/news/

RE: log all dropped packets

[Yogini Parkhi]

For Q1. You can do a little trick and create a user chain called LOGDROP and then use that.
e.g.
iptables -N LOGDROP
iptables -j LOG -log-preifx "LOGDROP: "

now, where ever you were using target DROP, use LOGDROP instead. This way you can make sure you log things before dropping.

For logging traffic handled by default policy you will have to have a last rule in all default chains - INPUT, OUTPUT, FORWARD that logs traffic with the right prefix.

Iptables -A INPUT -j LOG -log-prefix "INPUTDEFAULT: "
Iptables -A INPUT -j LOG -log-prefix "FORWARDDEFAULT: "
Iptables -A INPUT -j LOG -log-prefix "OUTPUTDEFAULT: "

Hope this helps you.
-Y



-----Original Message-----
From: SB CH [mailto:chulmin2@hotmail.com]
Sent: Tuesday, October 01, 2002 6:19 PM
To: netfilter@lists.netfilter.org
Subject: log all dropped packets

Hello, all.

my two questions are similar.

Question1.
I would like to log all Dropped packet.
How can I write a log about all dropped packet?


Question2.
Surely, my default policy is DROP.
and one can't log about related default Policy.
How can I log packet information about default policy related?


Thanks in advance.



_________________________________________________________________
보다 빠르고 보기 편한 뉴스. 오늘의 화제는 MSN 뉴스에서 확인하세요.
http://www.msn.co.kr/news/

RE: log all dropped packets

[Yogini Parkhi]

For Q1. You can do a little trick and create a user chain called LOGDROP and then use that.
e.g.
iptables -N LOGDROP
iptables -j LOG -log-preifx "LOGDROP: "

now, where ever you were using target DROP, use LOGDROP instead. This way you can make sure you log things before dropping.

For logging traffic handled by default policy you will have to have a last rule in all default chains - INPUT, OUTPUT, FORWARD that logs traffic with the right prefix.

Iptables -A INPUT -j LOG -log-prefix "INPUTDEFAULT: "
Iptables -A INPUT -j LOG -log-prefix "FORWARDDEFAULT: "
Iptables -A INPUT -j LOG -log-prefix "OUTPUTDEFAULT: "

Hope this helps you.
-Y



-----Original Message-----
From: SB CH [mailto:chulmin2@hotmail.com]
Sent: Tuesday, October 01, 2002 6:19 PM
To: netfilter@lists.netfilter.org
Subject: log all dropped packets

Hello, all.

my two questions are similar.

Question1.
I would like to log all Dropped packet.
How can I write a log about all dropped packet?


Question2.
Surely, my default policy is DROP.
and one can't log about related default Policy.
How can I log packet information about default policy related?


Thanks in advance.



_________________________________________________________________
보다 빠르고 보기 편한 뉴스. 오늘의 화제는 MSN 뉴스에서 확인하세요.
http://www.msn.co.kr/news/