Log ARP headers

Slavko <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
Hi,

i want to log ARP headers, thus i create arp family table
with one chain with only one rule, somethong as:

    arp operation request limit ... countef log group 2 prefix ...

It basically works, counter grows and packets are logged
via ulogd2 stack::

    stack=log2a:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,gp1:GPRINT

Except that the log entries has not any ARP headers.

Then i found this article [1], which mentions the ARP as
sysctlt key:

    net.netfilter.nf_log.3

Thus i set it to "nfnetlink_log", but that doesn't help. It
is hard to find what these numbers are, but i guess that
family constants, as 2, 7 and 10 (from ulogd2 start log)
coresponds to inet, inet6 and bridge family, but i am not
aware of arp family...

I guess that ulogd2 is able to log ARP headers as i found
them in BASE plugin's info output, but please what i have
to do to get them into log? Or problem is, that i play with
it inside LXC container (other logging works in it)?

regards

[1] <https://fedoramagazine.org/network-address-translation-part-4-conntrack-troubleshooting/

-- 
Slavko
https://www.slavino.sk/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.