[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: cleaning up my firewall script...



I think tcpdump may be the way to go then.  Try first with 
iptraf, as it's not so low level.  Both of these are network
packet sniffers and are a must have for any fierwall.

--- Bjoern Schmidt <bj-schmidt@uni-paderborn.de> wrote:
> Mike Mestnik wrote:
> > IIRC you can pass logs to any facility and level, even making up your own.  Then you add
> something
> > like...
> > # in /etc/syslog.conf
> > myfacility.*      /var/log/netjunk.log
> 
> For this i can use the ULOG target, but you asked for the whole
> packet...
> 
> > 
> > --- Bjoern Schmidt <bj-schmidt@uni-paderborn.de> wrote:
> > 
> >>Mike Mestnik wrote:
> >>
> >>>That's surprising...
> >>>It could be pkts from a non IP interface(maby your loopback?) or from a non IP protocol? 
> Even
> >>
> >>so
> >>
> >>>they should have been caught by your blank rule.  This would seam like a problem, one that
> >>
> >>could
> >>
> >>>be explotable.  See if you can catch the pkts in question with tcpdump or the like, that
> might
> >>
> >>be
> >>
> >>>helpfull.
> >>>
> >>
> >>
> >>Is there any netfilter target which redirects packets into one or more
> >>files? An existing FILELOGGER target would be great:
> >>
> >>iptables -P INPUT -j FILELOGGER --d-folder /slippedpackets/
> >>
> >>Then i could change the chain policy to save these packets in an easier
> >>way than using tcpdump...
> >>
> >>-- 
> >>Greetings
> >>Bjoern Schmidt
> >>
> >>
> >>
> >>-- 
> >>To UNSUBSCRIBE, email to debian-firewall-request@lists.debian.org
> >>with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> >>
> > 
> > 
> > 
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! Finance: Get your refund fast by filing online.
> > http://taxes.yahoo.com/filing.html
> > 
> > 
> 
> 
> -- 
> Mit freundlichen Gruessen
> Bjoern Schmidt
> 
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-firewall-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> 


__________________________________
Do you Yahoo!?
Yahoo! Finance: Get your refund fast by filing online.
http://taxes.yahoo.com/filing.html



Reply to: