Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables.

From the iptables man for TRACE:

   This target marks packes so that the kernel will log every  rule  which
   match  the  packets  as  those traverse the tables, chains, rules. (The
   ipt_LOG or ip6t_LOG module is required for the  logging.)  The  packets
   are   logged   with   the   string   prefix:  "TRACE:  tablename:chain-
   name:type:rulenum " where type can be "rule" for plain  rule,  "return"
   for  implicit  rule at the end of a user defined chain and "policy" for
   the policy of the built in chains.
   It can only be used in the raw table.

I use the following rule: iptables -A PREROUTING -t raw -p tcp -j TRACE but nothing is appended either in /var/log/syslog or /var/log/kern.log!

Is there another step missing? Am I looking in the wrong place?


Even though I can't find log entries, the TRACE target seems to be set up correctly since the packet counters get incremented:

# iptables -L -v -t raw
Chain PREROUTING (policy ACCEPT 193 packets, 63701 bytes)
 pkts bytes target     prot opt in     out     source               destination
  193 63701 TRACE      tcp  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 178 packets, 65277 bytes)
 pkts bytes target     prot opt in     out     source               destination

edit 2

The rule iptables -A PREROUTING -t raw -p tcp -j LOG does print packet information to /var/log/syslog... Why doesn't TRACE work?

share|improve this question
just stumpled upon a python program (which is also called iptables-trace :). When started it adds a TRACE rule with specified conditions into running iptables, parses and display formatted output for resulting TRACE output until the program is stopped (which removes the TRACE rule from iptables). Will try this soon... – chris May 31 at 19:31
up vote 5 down vote accepted

You need to run:

modprobe ipt_LOG. 

That did it for me.

share|improve this answer
Thanks, that worked! The logs are available in /var/log/syslog or /var/log/kern.log – bernie Sep 24 '12 at 18:55

I found that I needed to perform both of the previous answers, in this order:

sudo modprobe ipt_LOG
sudo sysctl net.netfilter.nf_log.2=ipt_LOG

Here are a couple of things that I discovered along the way.

You can get a list of valid loggers (along with the currently selected logger) with the following:

cat /proc/net/netfilter/nf_log

The numbers here represent the protocol family numbers, as defined in /usr/include/bits/socket.h. 2 is AF_INET (that's IPv4), and 10 is AF_INET6 (IPv6).

share|improve this answer

This worked for me sudo sysctl net.netfilter.nf_log.2=ipt_LOG

share|improve this answer

Seems like (i.e. works for me) with new kernel this is needed (for IPv4):

modprobe nf_log_ipv4
sysctl net.netfilter.nf_log.2=nf_log_ipv4


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.