6

I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address information logged as well. Like:

"....OUT=eth1 IN= MAC=00:26:a9:7b:c9:30:00:17:0f:ac:6a:80:08:00"...

These mac-addresses related logs are sporadic.

What I have noticed:

  • these dropped/mac-logged communication are always inbound
  • the source mac-address logged is the one of my default-gateway (Service Provider), although the source IPs are different.
  • the destination mac (obvious but just to confirm) is the one of my interface

What I'm trying to understand:

  • what is the iptables logic when deciding to capture in the logs "MAC addresses + IP/port" instead of "IP/port" only.
  • Can you show what your iptables ruleset looks like? – chicks Oct 26 '15 at 12:18
  • You can use log prefix to pinpoint the specific iptables rule: see --log-prefix "" – nrc Nov 11 '15 at 21:50
2

The MAC information is only logged for devices on your local network. It is actually a hex dump of the ethernet MAC header and consists of the source MAC address (00:26:a9:7b:c9:30), destination MAC address (00:17:0f:ac:6a:80) and ethernet frame type (08:00).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.