Logging

Hi.

I am currently working on a not so simple firewall setup on a modern machine (Xeon, Gigs of memory, SCSI subsystem).

As part of it, I would like to know various "event" statistics.Questions I would like to answer is "How many hits on port 1433 have i got, and how is that distributed amongst the machines". Think pivot table data.

Is there some way to get netfilter to collect rule hits (like with no -j clause) for a each port/ip-address individually within a range ? Other than creating thousands of lines of rules and add them to my "firewall-startup" script (which is currently slightly less than 80 rules).

I have thought of just logging all traffic and running it through a userspace program via syslog-ng, but frankly I worry about performance (the firewall should be able to filter at least the 100Mbps connection, it currently sits on) under flooding.

Your thoughs are apprieciated :)

Svenne

Have LogWatch process the /var/log/message file and produce a medium level detail report. You'll get output similar to the following:

Dropped 603 packets on interface eth3
From 4.78.20.2 - 12 packets to udp(53)
From 12.120.1.21 - 10 packets to
tcp(4355,10045,12579,17520,18552,36906,53249,54319,58702,62703)
From 12.120.1.22 - 9 packets to
tcp(4063,11107,13063,30538,37001,40758,45575,48153,57370)
From 12.130.62.16 - 24 packets to udp(53)
From 60.26.129.15 - 8 packets to
tcp(5554,9898,5554,9898,5554,9898,5554,9898)
From 61.152.167.59 - 4 packets to tcp(22,22,22,22) From 61.221.58.212 - 4 packets to tcp(22,22,22,22) From 62.105.6.52 - 1 packet to icmp(0)

You can then further parse it as needed. You don't need a unique log rule for each port and/or IP. LogWatch will sort it all out for you.

HTH,
Chris

You might want to take a look at the ACCOUNT match (http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ACCOUNT).

Grant. . . .