iptables LOG function

[赤松 徹]

You are not wrong!

In packet log(/var/log/messages), MAC= information is a MAC address and
protocol number.
So, this information is a FRAME HEADER.
Last 2 are protocol number, 08:00 is a IP(Network byte order).

> When iptables logs incoming packets the MAC adresses are stored. They
> consist of 14 : seperated values.
>
> The question is, what are the 2 last values? The 6 first are my MAC
> adress, the 6 next are the ones from the gateway the package last passed.
> Or am I wrong?
>
> Sebastian
>