Logging traffic - Revision history

Plushkava: Employ the https:// scheme for the links

2023-12-19T13:24:05Z

Employ the https:// scheme for the links

← Older revision		Revision as of 13:24, 19 December 2023
Line 25:		Line 25:
	= Queueing logging to userspace =		= Queueing logging to userspace =

	As in iptables, you can use the existing ''nflog'' infrastructure to send log messages to [~~http~~://www.netfilter.org/projects/ulogd/ ulogd] or your custom userspace application based on [~~http~~://www.netfilter.org/projects/libnetfilter_log/ libnetfilter_log].		As in iptables, you can use the existing ''nflog'' infrastructure to send log messages to [https://www.netfilter.org/projects/ulogd/ ulogd] or your custom userspace application based on [https://www.netfilter.org/projects/libnetfilter_log/ libnetfilter_log].

	To do so, you only have to indicate the ''nflog'' group:		To do so, you only have to indicate the ''nflog'' group:

Plushkava: Correct the link to the ulogd project

2023-12-19T13:21:53Z

Correct the link to the ulogd project

← Older revision		Revision as of 13:21, 19 December 2023
Line 25:		Line 25:
	= Queueing logging to userspace =		= Queueing logging to userspace =

	As in iptables, you can use the existing ''nflog'' infrastructure to send log messages to [http://www.netfilter.org/projects/~~ulogd2~~/ ~~ulogd2~~] or your custom userspace application based on [http://www.netfilter.org/projects/libnetfilter_log/ libnetfilter_log].		As in iptables, you can use the existing ''nflog'' infrastructure to send log messages to [http://www.netfilter.org/projects/ulogd/ ulogd] or your custom userspace application based on [http://www.netfilter.org/projects/libnetfilter_log/ libnetfilter_log].

	To do so, you only have to indicate the ''nflog'' group:		To do so, you only have to indicate the ''nflog'' group:

Duncan: It's just "level" to introduce syslog level

2017-11-26T22:52:14Z

It's just "level" to introduce syslog level

← Older revision		Revision as of 22:52, 26 November 2017
Line 79:		Line 79:
	Some additional options exist to fine-tune logging in different scenarios:		Some additional options exist to fine-tune logging in different scenarios:

	* '''~~syslog-~~level''': Syslog level of logging, a string of value: emerg, alert, crit, err, warn [default], notice, info, debug		* '''level''': Syslog level of logging, a string of value: emerg, alert, crit, err, warn [default], notice, info, debug
	* '''snaplen''': Length of packet payload to include in netlink message (unsigned integer, 32 bit)		* '''snaplen''': Length of packet payload to include in netlink message (unsigned integer, 32 bit)
	* '''queue-threshold''': If queing logging to userspace, number of packets to queue inside the kernel before sending them to userspace (unsigned integer, 32 bit)		* '''queue-threshold''': If queing logging to userspace, number of packets to queue inside the kernel before sending them to userspace (unsigned integer, 32 bit)

Arturo: add documentation about additional logging options

2017-09-07T09:47:47Z

add documentation about additional logging options

@@ Line 73: / Line 73: @@
 <source>
 % nft add rule x y log flags all
 </source>

Arturo: add some bits about log flags

2017-01-05T11:13:55Z

add some bits about log flags

← Older revision		Revision as of 11:13, 5 January 2017
Line 40:		Line 40:

	And you'll start seeing log messages for each new ''ssh'' connection.		And you'll start seeing log messages for each new ''ssh'' connection.

			= Log flags =

			Since nftables v0.7, log flags are supported.

			Enable logging of TCP sequence and options:

			<source>
			% nft add rule x y log flags tcp sequence,options
			</source>

			Enable IP options:

			<source>
			% nft add rule x y log flags ip options
			</source>

			Enable socket UID:

			<source>
			% nft add rule x y log flags skuid
			</source>

			Enable ethernet link layer address:

			<source>
			% nft add rule x y log flags ether
			</source>

			Enable all flags:

			<source>
			% nft add rule x y log flags all
			</source>

Pablo: Created page with "'''Note''': Full logging support is available starting Linux kernel 3.17. If you run an older kernel, you have to modprobe ipt_LOG to enable logging. You can log packets usin..."

2016-07-13T17:58:36Z

Created page with "'''Note''': Full logging support is available starting Linux kernel 3.17. If you run an older kernel, you have to modprobe ipt_LOG to enable logging. You can log packets usin..."

New page

'''Note''': Full logging support is available starting Linux kernel 3.17. If you run an older kernel, you have to modprobe ipt_LOG to enable logging.

You can log packets using the ''log'' action. The most simple rule to log all incoming traffic is:

<source lang="bash">
% nft add rule filter input log
</source>

A typical rule match, log and accept incoming ''ssh'' traffic looks like:

<source lang="bash">
% nft add rule filter input tcp dport 22 ct state new log prefix \"New SSH connection: \" accept
</source>

The prefix indicates the initial string that is used as prefix for the log message.

Note that nftables allows to perform two actions in one single rule, contrary to ''iptables'' which required two rules for this.

Also note that the rule is evaluated from the left to the right. So the following rule:
<source lang="bash">
nft add rule filter input iif lo log tcp dport 22 accept
</source>
will log all packets coming on lo interface and not only the ones with destination port 22.

= Queueing logging to userspace =

As in iptables, you can use the existing ''nflog'' infrastructure to send log messages to [http://www.netfilter.org/projects/ulogd2/ ulogd2] or your custom userspace application based on [http://www.netfilter.org/projects/libnetfilter_log/ libnetfilter_log].

To do so, you only have to indicate the ''nflog'' group:

<source lang="bash">
% nft add rule filter input tcp dport 22 ct state new log prefix \"New SSH connection: \" group 0 accept
</source>

Then, run the example test application:

<source lang="bash">
libnetfilter_log/utils% ./nfulnl_test
</source>

And you'll start seeing log messages for each new ''ssh'' connection.