Re: logging of successful tcp connections

[Taylor Grant <gtaylor@riverviewtech.net>]

> Hrmm... I've looked over the recent patch, but I'm not certain how to
> implement this 'and' logic "if it's in list A, but not in list B".. etc.

If you wanted to see if a packet was transitioning from NEW to ESTABLISHED I think it would be as simple as something like the following:

iptables -t filter -A FORWARD -i $INet -o $LAN -d $INet_IP -m recent --rcheck --name recent_NEW -m recent ! --rcheck --name recent_ESTABLISHED -j Transition_to_ESTABLISHED

I'm not sure about the placement of the "!" on the line, you might have to play with it a bit to make sure that the syntax is correct.  Anyone have any input here?

> There must be some place in the connection tracking code where a simple
> log can be placed. I'm not that familiar with the internals, but it
> would seem that just before updating the state, you could just printk a
> log. Am I way off here?

I'm sure there is a place in the kernel code that this could be put, though I don't know as if many people would want such a thing.  It might be able to be there and something that is off by default and then turned on via /proc.



Grant. . . .