IPTABLES log to file any input traffic
I want to do some kind of "gofencing". That is if my phone with WiFi turn on will be in range of my home WiFi network and will generate any traffic to my Raspberry Pi (Ubuntu 14.04 32 bit), I want to log this traffic to file other than /var/log/something. For me important is that it could be any traffic (UDP or TCP) and such solution must recognise such traffic by MAC address of phone not by IP address because even DHCP broadcast must be logged.
Take care, that I im not interested in any particular traffic or protocol or packet but I want to catch of any possible traffic. Be so kind to help me to resolve that problem. |
In an appropriate spot in your rules file:
Code:
-A INPUT -j LOG |
I try something like this:
Code:
iptables -A INPUT -i eth0 -m mac --mac-source 90:b6:86:38:46:fa -j LOG --log-prefix "Note4" |
Have you tried ulogd? It should work if rsyslog is unavailable, but you'll have to go through some added configuration.
|
Physically I have (r)syslog installed but daemon is disabled because it writes to file /var/log/something so it reduce dramatically lifespan of SD card. I enable syslog if necessary only. The same situation is with ulogd. Still writing to SD card located file not to stdout. My goal is to analyse logs line by line not write it to file. Except temporary file located in RAM shared memory.
|
Use ulogd and write output to a named pipe which your analysis application uses for input.
|
Named pipe - sounds good. But it is still writing to file. As I mentioned, all system is located on SD card so placeig such file on SD reduce its lifespan. The solution is write it to RAM. But RAM has limited size. So is it possible to write such logs line by line to file in that way that new line overwrite older one? I am not interesting in details of logs but only in presence of such one "catch" by iptables log rule.
|
Code:
iptables -L -nv |
Quote:
|
Quote:
Code:
A FIFO special file (a named pipe) is similar to a pipe, except that it is accessed as part of the Quote:
Quote:
If you are going to ask for help, please at least seriously consider the replies offered. Quote:
Again, man iptables. |
All times are GMT -5. The time now is 10:59 PM. |