2
votes
1answer
26 views

IPTables custom log failing

I'm currently trying to split out some of my IPTables logging from kern.log into a file called iptables.log. Basically, I have several different adapters and I'm logging requests to port 80 on each ...
1
vote
1answer
197 views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
1
vote
0answers
162 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
-2
votes
1answer
168 views

Configure Protocols using iptables log file with ndpi [closed]

I am using iptables with ndpi to filter my network and add two rules to my iptables rules they are iptables -I INPUT -m ndpi --http -j LOG iptables -I INPUT -m ndpi --google -j LOG In my log file ...
0
votes
2answers
970 views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
4
votes
2answers
241 views

iptables SSH connection logging

Is it possible to only write a log-entry when a connection is established ? I have tried: iptables -I OUTPUT -p tcp --dport 22 -j LOG --log-level notice --log-prefix "outgoing ssh connection" to ...
0
votes
1answer
326 views

Log DNS queries (Source IP, Record Type, Hostname) using iptables

I'm looking for a way to log DNS queries using iptables for vpn users. What I'm looking for is to record in the syslog the source IP, the Record type and the domain name for new DNS queries. I've ...
0
votes
1answer
178 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
1
vote
0answers
131 views

iptables log nowhere to be found

I'm trying to log when IPTables drops connections mostly for analysis. Problem is, my log seems to be written to... nowhere. By this time I know that iptables logs through kern facility and for this, ...
0
votes
1answer
109 views

IP logging on a Linux access point [closed]

Here I'm using my RaspberryPi as a WLAN router. It is connected to my LAN by wire (which leads to my DSL router), additionally it is equipped with a USB WLAN stick. I'm using hostapd for providing the ...
-6
votes
2answers
148 views

Someone is using a lot of bandwith through OpenVPN, how can I find out who?

I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN. I think it is a torrent because it is upload + download 24/7. I want to find out ...
1
vote
0answers
284 views

iptables: how to decide what to log for a web server?

There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain: -A INPUT -j LOG ...
1
vote
1answer
232 views

Understanding log messages from iptables

I have enabled logging with iptables. Now, I need to understand some of the abbreviations. Feb 23 20:43:08 spiderman kernel [ 2905.992450]: IN=wlan0 OUT= ...
1
vote
1answer
127 views

Unable to log iptables

I'm having trouble getting iptables to log to any file. My iptables looks like: Chain INPUT (policy ACCEPT 1366 packets, 433582 bytes) pkts bytes target prot opt in out source ...
4
votes
3answers
635 views

iptables: How to read this OPT string?

I have a simple INPUT rule for iptables that logs any new connections to a logfile. --log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output. One line of my log ...
0
votes
1answer
96 views

Centos log stream for iptables failed

I am trying to block all connections to my pop3, imap server excepting my ip address and log dropped connections to a logfile /etc/sysconfig/iptables ... -N accept-n-log -A accept-n-log -j LOG ...
1
vote
1answer
1k views

Rotating Iptables logs with logrotate

I'm running CentOS6 and I configured rsyslog to monitor my iptables warning messages and dump them in /var/log/iptables.log. I went through my logrotate.d/syslog file and added iptables.log so ...
0
votes
1answer
330 views

Kernel Logging disabled?

uname -a Linux host 2.6.32-279.9.1.el6.i686 #1 SMP Tue Sep 25 20:26:47 UTC 2012 i686 i686 i386 GNU/Linux And start ups: ls /etc/init.d/ abrt-ccpp certmonger dovecot irqbalance ...
2
votes
0answers
129 views

a good tool to analyse iptables log? [closed]

I have some linux server with iptables and I'm looking for an offline tool that allow log analysis to detect suspicious activity . I dont think that installing a web tool is a good choice beacause ...
0
votes
0answers
61 views

how to log all forward ip address

I am running vpn servers, but some customers using vpn sending spams so I want to log all ip forward information into a log file eg: x.x.x.x(public IP)--->forward 10.0.0.x(vpn privated IP) if ...
3
votes
3answers
2k views

How to Enable IPtables TRACE Target on Debian Squeeze (6)

I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables. From the iptables man for TRACE: ...
0
votes
1answer
585 views

Iptables doesn't log to /var/log/kern.log or syslog

iptables -A FORWARD -p tcp -j LOG --log-level debug or iptables -A FORWARD -p tcp -j LOG --log-level info or iptables -A INPUT -p tcp -j LOG --log-prefix ' INPUT TCP ' --log-level 7 Doesn't log ...
0
votes
2answers
437 views

iptables log parser

I want a program who feed iptables log and print it in readable form. This bugs me out: Apr 23 19:36:27 ******* kernel: [ 8195.237958] iptables DROP: IN= OUT=wlan0 SRC=192.168.1.102 ...
1
vote
1answer
65 views

Iptables: how do I LOG what's not being ACCEPTED and limit what gets logged?

How do I log what's not being accepted by the following rule: iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT And how do I limit what's being logged because I don't ...
0
votes
1answer
237 views

iptables doesn't want to log and drop simultaneously

I'm (still) trying to build an iptables firewall, but this time, I'm stuck trying to log dropped packets. Here is how I'm doing this (this code is inserted after the ACCEPT rules; $IPT represents the ...
0
votes
1answer
252 views

Logging websites with iptables

I currently have a Sokeris net4501 running Voyage Linux acting as a firewall using iptables. Is it possible to use iptables to log all websites that are visited? If not, is there any other software ...
2
votes
1answer
645 views

CentOS and iptables Logging

I am working with some CentOS rules and would like to be able to log the dropped items from iptables out to a separate file. What is the best way to setup CentOS to log dropped iptables matches to a ...
0
votes
1answer
222 views

Set alternate log file for iptables with syslog-ng

Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
289 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
2
votes
5answers
301 views

Linux Traffic Logging

I'm looking for a good free method of logging IP heading information (src/dest IP with timestamp) passing through a Linux router. I know I can do this with tcpdump -i eth0 > log.txt However I'm ...
1
vote
1answer
649 views

How to interpret “port scans” from log

We use CSF on our server, and it automatically blocks IPs if it detects a port scan. This is the report we get when such an event occurs: Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN ...
1
vote
2answers
392 views

How do I know what connections has my debian server blocked?

In short, I am actually looking for the log files to see any incoming connection being blocked in debian lenny server. Or any other way to know? I am using iptables
4
votes
1answer
6k views

How can I log iptables in Ubuntu just in /var/log/firewall with rsyslogd

I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile. So I added the following line to my file: ...
0
votes
5answers
3k views

iptables logging not working?

OS: Ubuntu 10.04 Logging daemon: rsyslog For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it ...
4
votes
4answers
3k views

Log every IP connecting on a system with iptables

Title says it all. How can I, with iptables under Linux, log all IP connecting to a server? As a little detail, I'd like to have only ONE entry in the log PER DAY PER IP. Thanks :) EDIT: I ...