Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here I'm using my RaspberryPi as a WLAN router. It is connected to my LAN by wire (which leads to my DSL router), additionally it is equipped with a USB WLAN stick. I'm using hostapd for providing the access point functionality. There is also dnsmasq running as the DHCP server. IPv4 forwarding is enabled and working fine.

But I have to log all IPs which my WLAN users are trying to connect to (stupid german laws).

The first idea, using iptables to log the destination IPs, fails because the destination IP of the incoming packets on wlan0 is always the IP address on wlan0 (it is the standard gateway for the WLAN clients).

What I need is a way to log when was which destination IP contacted, nothing more. Preferably a solution without all the bells and whistles. ;)

share|improve this question

closed as off topic by Michael Hampton, mdpc, Ward, Dave M, Iain Jan 20 '13 at 20:13

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Pis aren't topical here because they're not servers within our faq. You may find a better place to ask is Super User, U&L or RaspberryPi – Iain Jan 20 '13 at 20:16
up vote 0 down vote accepted

Your idea is correct.

Just log the first packet:

iptables -I INPUT -m state --state new -i wlan0 -j LOG

Log on the incomming interface

The DST= field shows the destination address.

You can then manage the log with syslog-ng or rsyslog. By default they will be sent to syslog.

share|improve this answer
Hm ok, this is definitely a start. What I'm still missing is a way to track the time there is really traffic to a certain IP address. I will have to further think about this problem. Thanks! – André Jan 20 '13 at 21:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.