Hello, everybody who read this message

What is the best way to log traffic trough firewall?
I have linux box with NAT (one external ip) and get mail from my ISP what my external ip is infected by virus. They sent my logs of virus activity, but in my linux box I don't make any logs and can't find which internal pc (Windows box) is infected... So I decided to start logging everything to find out in future witch pc is infected.

Linux box (router/firewall) is 633MHz Celeron and where are about 100 users. Please share your experiance with me.

Thanks for any answer.

If you want to log any traffic you may use a packet sniffer.
You may do this with snort, but you can also use it as an IDS (intusion detection System), make it log in a database (mysql) and use base to watch the output. If one of the systems is sending weird packages, snort should create alerts.

snort homepage: http://www.snort.org/
base: http://secureideas.sourceforge.net/
a guide to install snort+base: http://sourceforge.net/project/shown...ease_id=303559

Also, linux use tcpdump to log trafic, read the man page

Thanks for info perfect_circle