Re: ebtables - logging packets in userspace

Op ma, 12-03-2007 te 12:42 -0700, schreef Mike Wood:
> I am using ebtables to filter some undesired traffic. However, I would 
> like to log all of the packets, preferably in libpcap format, that I 
> filter for further analysis.
> 
> I was trying to use the ebt_ulog --ulog watcher, but when I read from 
> the corresponding netlink socket using netfiler's ulogd, I get a 
> 'corrupt' pcap file that is unreadable by tcpdump. I have seen a few 
> emails on the netfilter mailing lists that say netfilter and ebtables 
> do not agree on netlink packet format, so I realize that's probably why 
> mixing ebtables ulog and netfilter ulogd doesn't jive so well.
> 
> Thus, I am curious what the approach is to solve my original problem - 
> wanting to log (pcap) all packets that get dropped by ebtables for some 
> particular ebtables rule. Do you have to get ebtables and iptables to 
> work together somehow, marking packets with ebtables and having those 
> packets passed to iptables so it can do the logging (and dropping?) 
> there?

There is an example program in the ebtables CVS directory that
demonstrates ebtables ulog usage. There is no complicated all-purpose
library available.
If you know how to program C, the example program should be enough.

cheers,
Bart



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV