Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a server that makes the routing for my LAN (Linux, CentOS). I would like to have on it the possibility of lawful interception: I want to be able to see all network traffic that was done from my LAN (date, MAC, source IP, destination IP, protocols, ports, and some other stuff related to network connections). Is that already implemented in linux, or do I need to write my own software?

Any thoughts would be appreciated.

share|improve this question
Do you just want to be able to log data, or really want to be CALEA/ETSI/... compliant? –  mulaz Nov 28 '12 at 10:51
@mulaz For the beginning I will be pleased with a simple logged data, but I'm also interested for a CALEA/ETSI/... compliant system. –  artaxerxe Nov 28 '12 at 11:21
I know nothing with regard to CALEA/ETSI... but for the simple logging aspect, wouldn't iptables be sufficient to log what you're looking for? I used iptables for years to do precisely what you're asking for (right up until I moved to pfsense). –  Josh Blair Nov 28 '12 at 11:55
@JoshBlair I think iptables would be ok, but what if I would need to have some extra information related to user (taken from a database for example)? –  artaxerxe Nov 28 '12 at 12:05
Hm. I believe you can set the default log level to debug and setup a specific file to offload your firewall logs to. I'm at work for the next 12 hours, so I can't hop on a machine to try this out myself. Hopefully somebody can confirm my thought or prove me to be crazy! :) –  Josh Blair Nov 28 '12 at 13:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.