From: Italo Valcy <italo@dcc.ufba.br>
To: jengelh@medozas.de
Cc: netfilter@vger.kernel.org
Subject: Re: How to log NAT translations
Date: Mon, 20 Sep 2010 23:25:13 -0300 [thread overview]
Message-ID: <4C981789.3070004@dcc.ufba.br> (raw)
In-Reply-To: <alpine.LNX.2.01.1009141953580.23103@obet.zrqbmnf.qr>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Jan,
Em 14-09-2010 14:54, Jan Engelhardt escreveu:
> On Tuesday 2010-09-14 19:24, Italo Valcy wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi guys!
>>
>> I'm a newbie in this mainling list, so I'm sorry if this question was
>> already asked.
>>
>> I'd like to have more specific logging output of NAT translation in
>> iptables. Is there an way to logging of ORIGINAL_IP/ORIGINAL_PORT +
>> TRANSLATED_IP/TRANSLATED_PORT?
>
> conntrack -E
Thank you for the reply.
Actually, I wanna something more simple and specific than the command
above. Using 'conntrack -E', I still have to parse the package events
NEW, UPDATE and DESTROY if I wanna know the of a NAT, for example.
Furthermore, with 'conntrack -E', in my opinion, we have an important
overhead of the output (it's so many messages to write to stdout - or
even redirect to a file)...
My ideia is to write a NAT (or conntrack) helper (as a kernel module)
that monitors the DESTROY event of a DNAT and try to find out when was
the NEW event of the same connection (maybe we have this information in
some struct..); then we write a log message (like LOG target does) which
contains ip_src-orig/port_src-orig,
ip_src-translated/port_src-translated, ip_dst/port_dst, duration of the
NAT (a little bit similar to Cisco/Asa NAT logging..). What do you
think? Where can I find some documentation to read?
Thank you so much for any help!
- --
Saudações,
Italo Valcy :: http://wiki.dcc.ufba.br/~ItaloValcy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkyYF4kACgkQfidLqjN6RNGBrgCdGeGdZe4jzY7cR9xM5zNqV/RJ
k20AnRl6VKzz31k2vSqgQmL5Tafm931s
=bUcw
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2010-09-21 2:25 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-09-14 17:24 How to log NAT translations Italo Valcy
2010-09-14 17:54 ` Jan Engelhardt
2010-09-21 2:25 ` Italo Valcy [this message]
2010-09-21 9:26 ` Jan Engelhardt
2010-09-21 9:45 ` Pablo Neira Ayuso
2010-09-21 10:22 ` Jozsef Kadlecsik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C981789.3070004@dcc.ufba.br \
--to=italo@dcc.ufba.br \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox