Target IP monitoring...
I'm going to be working on a project that will need to monitor what destination IPs traffic is sent to. I was wondering if I could not use the ULOG in side of the nat table to do this. I am really only wanting the target (and possibly the source) IP of each connection. I do not want any of the IP payload or any of the packets, just the target IP.
I was hoping to exploit the fact that the nat table only sees the first packet in a connection to help reduce the likelihood that I would see the same target IP multiple times.
I am not doing any filtering with this so the fact that ULOG is a non terminating target is not a problem for me.
Grant. . . .
Quoted 9 lines · Grant Taylor
I'm going to be working on a project that will need to monitor what destination IPs traffic is sent to. I was wondering if I could not use the ULOG in side of the nat table to do this. I am really only wanting the target (and possibly the source) IP of each connection. I do not want any of the IP payload or any of the packets, just the target IP.
I was hoping to exploit the fact that the nat table only sees the first packet in a connection to help reduce the likelihood that I would see the same target IP multiple times.
Eww no, don't do that. Though Netfilter is written like that, there is no hard guarantee that only first packets are seen. (Like, we forget to take our medication and all packets go through the then-semi-stateless nat table ;-) Better use -m conntrack --ctstate NEW -j ULOG.
Quoted 1 line · Jan Engelhardt
Eww no, don't do that. Though Netfilter is written like that, there is no hard guarantee that only first packets are seen. (Like, we forget to take our medication and all packets go through the then-semi-stateless nat table ;-) Better use -m conntrack --ctstate NEW -j ULOG.
*nod*
So technically it /would/ work, but it would also be bad form to do it that way.
Grant. . . .