logging of successful tcp connections
gtaylor at riverviewtech.net
Fri Apr 22 01:55:01 CEST 2005
> Hrmm... I've looked over the recent patch, but I'm not certain how to
> implement this 'and' logic "if it's in list A, but not in list B".. etc.
If you wanted to see if a packet was transitioning from NEW to ESTABLISHED I think it would be as simple as something like the following:
iptables -t filter -A FORWARD -i $INet -o $LAN -d $INet_IP -m recent --rcheck --name recent_NEW -m recent ! --rcheck --name recent_ESTABLISHED -j Transition_to_ESTABLISHED
I'm not sure about the placement of the "!" on the line, you might have to play with it a bit to make sure that the syntax is correct. Anyone have any input here?
> There must be some place in the connection tracking code where a simple
> log can be placed. I'm not that familiar with the internals, but it
> would seem that just before updating the state, you could just printk a
> log. Am I way off here?
I'm sure there is a place in the kernel code that this could be put, though I don't know as if many people would want such a thing. It might be able to be there and something that is off by default and then turned on via /proc.
Grant. . . .
More information about the netfilter