[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [PATCH] netfilter: audit target to record accepted/dropped packets



On Fri, Jan 14, 2011 at 10:20 AM, Thomas Graf <tgraf infradead org> wrote:
> This patch adds a new netfilter target which creates audit records
> for packets traversing a certain chain.
>
> It can be used to record packets which are rejected administraively
> as follows:
>
>  -N AUDIT_DROP
>  -A AUDIT_DROP -j AUDIT --type DROP
>  -A AUDIT_DROP -j DROP
>
> a rule which would typically drop or reject a packet would then
> invoke the new chain to record packets before dropping them.
>
>  -j AUDIT_DROP
>
> The module is protocol independant and works for iptables, ip6tables
> and ebtables.
>
> The following information is logged:
>  - netfilter hook
>  - packet length
>  - incomming/outgoing interface
>  - MAC src/dst/proto for ethernet packets
>  - src/dst/protocol address for IPv4/IPv6
>  - src/dst port for TCP/UDP/UDPLITE
>  - icmp type/code
>
> Cc: Patrick McHardy <kaber trash net>
> Cc: Eric Paris <eparis parisplace org>
> Cc: Al Viro <viro ZenIV linux org uk>
> Signed-off-by: Thomas Graf <tgraf redhat com>

>From an audit PoV feel free to add

Acked-by: Eric Paris <eparis redhat com>


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]