Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a good free method of logging IP heading information (src/dest IP with timestamp) passing through a Linux router.

I know I can do this with

tcpdump -i eth0 > log.txt

However I'm looking for something a bit more substantial, as this will be running all the time.

share|improve this question

If you want detailed logging, I suggest ulogd.

share|improve this answer
ulogs seems good. I'm guessing that the ULOG target will return back to the FORWARD chain? Also, in your opinion, would it be better to run this on a dedicated box with its NIC in promiscuous mode, given that this will be running 24/7 outputting to a DB? – jtnire Apr 3 '11 at 21:04
Well, that depends on the traffic volume. The ulogd daemon has a small footprint, so its fine. If you wanna log to mysql, that should probably not run on the router if this is production environment. – Bittrance Apr 3 '11 at 21:18

iptables can do this natively. just put a LOG or ULOG target early in your chains. You'll also have to play with rsyslogd to get the iptables logs out of the kernel logging stream and into a file of your choosing. This necessitates you putting some unique characters in the log text you select with the iptables rules (something like ":FW:") so you can tell rsyslogd to filter based on that string and put it in its own file.

share|improve this answer

I really like using argus for this. It is a software package that promiscuously listens on an interface and writes out flow data similar to (net|j)flows. It uses the client/server model, where the server daemon performs the capture and writes the data files, and the client tools are used to read and analyze the data files. The output files are written into a binary format, so some learning curve in the included tools is necessary.

Using a (nearly) default config what follows is an anonymized version of the basic output:

StartTime            Proto    SrcAddr  Sport          Dir   DstAddr  Dport       SrcPkts  DstPkts     SrcBytes     DstBytes State  
31 Jan 11 23:20:07   icmp             ->               1        0           60            0   ECO
31 Jan 11 23:48:07    tcp     ->         1        0           60            0   REQ
01 Feb 11 01:10:59   icmp           ->               1        0           60            0   ECO
01 Feb 11 01:11:00   icmp           ->               1        0           60            0   ECO
01 Feb 11 01:13:45    tcp     ->         1        0           60            0   REQ
01 Feb 11 01:36:13    udp       ->          1        0          454            0   INT
01 Feb 11 03:22:34    tcp     ->         1        0           60            0   REQ
01 Feb 11 04:05:51    tcp     ->         1        0           60            0   REQ
01 Feb 11 04:48:32    tcp     ->         1        0           60            0   REQ

It is designed to run as a service, however you must figure out the best way to rotate out files depending on your system, storage, and throughput. You should be able to point it at one of your router's interfaces and get all of the information you desire.

As a bonus, tt also comes with a significant number of helper utilities with which you can do fun stuff like traffic graphs, accounting, and other kinds of analysis. See the NSMWiki page for some details on exactly the kind of analysis that can be run.

share|improve this answer

ntop ? If i understand what you want. that'll give you a nice web interface for all the data, and its easy as pie to install.

share|improve this answer

Pastmon? mrtg?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.