Re: iptables log only
"G.W. Haywood" <[email protected]>
| Newsgroups | gmane.comp.security.ipcop.user |
|---|---|
| Message-ID | <[email protected]> |
Hi there, On Tue, 12 Jul 2016, Joe Acquisto-j4 wrote: > Cop 2.x > > Lets say I create an outbound rule on RED, to only log requests on a certain port. Easy enough using GUI. > > So, log shows suspected delays in response, or no response at all. How can I log the reply to such a request. Does not seem possible via GUI, but a casual scan > of IPTables does not reach out and grab my focus on where to put my entry. > > Suggestions? If I've understood you correctly, you want to log packets which reply to outgoing packets which were sent to a particular port irrespective of the IP address to which they are sent. Is that correct? If so, I don't think that's going to be easy without deep packet inspection or knowledge of the protocol(s) being used for the conversation. If you have an Ethernet interface on RED then you can plug a hub in there to use another machine to monitor the traffic. Something like Wireshark running on that other machine will help enormously, as it understands all sorts of protocols and can look inside the packets. You can do the same sort of thing with a hub on GREEN if you know that only machines on GREEN are sending the original packets, and you don't have other interfaces (e.g. BLUE, ORANGE...) to worry about. You can do tricky things with iptables to look inside packets but IMO it's not really the tool for the job you're trying to do (and which you could usefully expand upon, I think). -- 73, Ged. ------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev _______________________________________________ IPCop-user mailing list [email protected] Manage your subscription or unsubscribe https://lists.sourceforge.net/lists/listinfo/ipcop-user