Re: [PATCH v7 2/2] audit: include source and destination ports to NETFILTER_PKT
Florian Westphal <[email protected]>
| Newsgroups | org.kernel.vger.audit,org.kernel.vger.linux-kernel,org.kernel.vger.netfilter-devel |
|---|---|
| Message-ID | <[email protected]> |
Ricardo Robaina <[email protected]> wrote: > NETFILTER_PKT records show both source and destination > addresses, in addition to the associated networking protocol. > However, it lacks the ports information, which is often > valuable for troubleshooting. > > This patch adds both source and destination port numbers, > 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and > SCTP-related NETFILTER_PKT records. > > $ TESTS="netfilter_pkt" make -e test &> /dev/null > $ ausearch -i -ts recent |grep NETFILTER_PKT > type=NETFILTER_PKT ... proto=icmp > type=NETFILTER_PKT ... proto=ipv6-icmp > type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424 > type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424 > type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424 > type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424 > > Link: https://github.com/linux-audit/audit-kernel/issues/162 Acked-by: Florian Westphal <[email protected]>