ebtables - logging packets in userspace

I am using ebtables to filter some undesired traffic. However, I would 
like to log all of the packets, preferably in libpcap format, that I 
filter for further analysis.

I was trying to use the ebt_ulog --ulog watcher, but when I read from 
the corresponding netlink socket using netfiler's ulogd, I get a 
'corrupt' pcap file that is unreadable by tcpdump. I have seen a few 
emails on the netfilter mailing lists that say netfilter and ebtables 
do not agree on netlink packet format, so I realize that's probably why 
mixing ebtables ulog and netfilter ulogd doesn't jive so well.

Thus, I am curious what the approach is to solve my original problem - 
wanting to log (pcap) all packets that get dropped by ebtables for some 
particular ebtables rule. Do you have to get ebtables and iptables to 
work together somehow, marking packets with ebtables and having those 
packets passed to iptables so it can do the logging (and dropping?) 
there?

Many thanks for any and all advice,
Mike


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV