Linux Netfilter discussions
 help / color / mirror / Atom feed
From: Brad Tilley <rtilley@vt.edu>
To: netfilter@lists.netfilter.org
Subject: Logging the whole packet
Date: Tue, 23 Nov 2004 16:50:28 -0500	[thread overview]
Message-ID: <41A3B0A4.9020906@vt.edu> (raw)

Is it possible to log the packet body and not just the header?

Currently I have this line in my iptables start-up file:

/sbin/iptables -I INPUT -p tcp -s ! 128.173.120.79 -d 128.173.120.79  -j 
LOG --log-prefix="Packet_Filter:"

And it generates log entries such as this:

Nov 23 16:44:28 athop1 kernel: Packet_Filter:IN=eth0 OUT= 
MAC=00:30:6e:5e:a2:0c:00:d0:01:ab:44:00:08:00 SRC=64.81.214.131 
DST=128.173.120.79 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=29621 DF 
PROTO=TCP SPT=60366 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0

I'd like to capture the packet body as well. I'm new to packet logging 
so forgive me if I'm over looking the obvious.

Thanks,
Brad


             reply	other threads:[~2004-11-23 21:50 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-11-23 21:50 Brad Tilley [this message]
2004-11-23 22:12 ` Logging the whole packet Jason Opperisano
2004-11-24  1:12   ` Brad Tilley
2004-11-24  2:26     ` Brad Tilley
2004-11-24 11:03   ` israel Gold
2004-11-24 14:58     ` Jason Opperisano
2004-11-24 17:30       ` israel Gold

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41A3B0A4.9020906@vt.edu \
    --to=rtilley@vt.edu \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox