Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I made the following changes to /etc/sysconfig/iptables

-A INPUT -s 0.0.0.0 -d 192.168.132.81 -p tcp -m tcp --dport 8000 -j LOG --log-prefix "TrialIpTables"

I was hoping to see a log whenever I access port 8000 of 192.168.132.81. However, I don't see anything in /var/log/messages. I have no idea how to start troubleshooting this.

share|improve this question
    
Could you please post the output of 'iptables -nv -L' and the contents of your syslog config file. –  wolfgangsz May 18 '11 at 10:05

2 Answers 2

I think the problem is the source address: when trying to accessing that port, you're not coming from 0.0.0.0. Try a source address with a broader netmask (/0), or, and this is the more sensible option, no source address at all.

Also, when troubleshooting IP tables, an /sbin/iptables -L -v will show how many packets and bytes have matched against a particular rule - in your case I believe it will be 0.

share|improve this answer
    
Thanks. /sbin/iptables -L -v shows "0 0 LOG tcp -- any any 0.0.0.0 192.168.132.81 tcp dpt:irdmi LOG level warning prefix `TrialIpTables'" which means that no packets matched. –  doon May 18 '11 at 12:03
    
did changing/removing the source have the expected effect? –  Norky May 20 '11 at 13:36

First of all, your log messages would probably be in syslog, not message. Try grep TrialIpTables /var/log/*.

Secondly, iptables may not create a log entry unless it blocks something or unless you turn the log level up. Those items you could lookup in the iptables documentation, but I think you might want to consider that this is actually a Bad Plan™. By doing excessively verbose logging like tracking all hits on a tcp port, you are creating a new attack surface. All somebody needs is to flood that port with connection requests and they will fill up your hard drive with log messages!

Perhaps you could think of another strategy to log access at a lower-verbosity point in the connection chain or reconsider how much information you need.

share|improve this answer
    
+1 to that. The --limit option is your friend for logging rules. –  Norky May 18 '11 at 10:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.