I have a server that makes the routing for my LAN (Linux, CentOS). I would like to have on it the possibility of lawful interception: I want to be able to see all network traffic that was done from my LAN (date, MAC, source IP, destination IP, protocols, ports, and some other stuff related to network connections). Is that already implemented in linux, or do I need to write my own software?

Any thoughts would be appreciated.

  • Do you just want to be able to log data, or really want to be CALEA/ETSI/... compliant? – mulaz Nov 28 '12 at 10:51
  • @mulaz For the beginning I will be pleased with a simple logged data, but I'm also interested for a CALEA/ETSI/... compliant system. – artaxerxe Nov 28 '12 at 11:21
  • 1
    I know nothing with regard to CALEA/ETSI... but for the simple logging aspect, wouldn't iptables be sufficient to log what you're looking for? I used iptables for years to do precisely what you're asking for (right up until I moved to pfsense). – Mountainerd Nov 28 '12 at 11:55
  • @JoshBlair I think iptables would be ok, but what if I would need to have some extra information related to user (taken from a database for example)? – artaxerxe Nov 28 '12 at 12:05
  • Hm. I believe you can set the default log level to debug and setup a specific file to offload your firewall logs to. I'm at work for the next 12 hours, so I can't hop on a machine to try this out myself. Hopefully somebody can confirm my thought or prove me to be crazy! :) – Mountainerd Nov 28 '12 at 13:50

If you really want to see all the traffic on the network, there is really no substitute for a packet sniffer, such as tcpdump. That will record the full contents of every packet according to the rules you've specified, and can log it to a file.

You'll also need a lot of disk space, depending on how much traffic passes through and how much you want to keep.

If you're just interested in logging the start times of connections, and keeping it for a long time, it's probably better to take the approach of logging on firewall rules being hit.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.