Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server that makes the routing for my LAN (Linux, CentOS). I would like to have on it the possibility of lawful interception: I want to be able to see all network traffic that was done from my LAN (date, MAC, source IP, destination IP, protocols, ports, and some other stuff related to network connections). Is that already implemented in linux, or do I need to write my own software?

Any thoughts would be appreciated.

share|improve this question
Do you just want to be able to log data, or really want to be CALEA/ETSI/... compliant? – mulaz Nov 28 '12 at 10:51
@mulaz For the beginning I will be pleased with a simple logged data, but I'm also interested for a CALEA/ETSI/... compliant system. – artaxerxe Nov 28 '12 at 11:21
I know nothing with regard to CALEA/ETSI... but for the simple logging aspect, wouldn't iptables be sufficient to log what you're looking for? I used iptables for years to do precisely what you're asking for (right up until I moved to pfsense). – Josh Blair Nov 28 '12 at 11:55
@JoshBlair I think iptables would be ok, but what if I would need to have some extra information related to user (taken from a database for example)? – artaxerxe Nov 28 '12 at 12:05
Hm. I believe you can set the default log level to debug and setup a specific file to offload your firewall logs to. I'm at work for the next 12 hours, so I can't hop on a machine to try this out myself. Hopefully somebody can confirm my thought or prove me to be crazy! :) – Josh Blair Nov 28 '12 at 13:50

If you really want to see all the traffic on the network, there is really no substitute for a packet sniffer, such as tcpdump. That will record the full contents of every packet according to the rules you've specified, and can log it to a file.

You'll also need a lot of disk space, depending on how much traffic passes through and how much you want to keep.

If you're just interested in logging the start times of connections, and keeping it for a long time, it's probably better to take the approach of logging on firewall rules being hit.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.