Hi

I need to detect the ip address of all outgoing and incoming packets on the outside of my LINUX firewall. Can someone advise me on the best way of doing this?

Thanks in advance

Sam

Are you using iptables? The following will log packets in and out of your PC.

If you have more than one network card, you should filter for the card that is connected to the internet. If the internet interface was eth1:

The above will log packets to /var/log/syslog or /var/log/messages depending on your system. There will be a LOT of data so you should prepare scripts to parse the log (or use something like logwatch)

iptables -I INPUT -i eth1 -j LOG
iptables -I OUTPUT -o eth1 -j LOG

If this doesn't answer your question, perhaps you could be a little more detailed in what you require, what you have tried, and what your goal is.

Hi,

sure enough you've got several ways to do so...
iptables can log the packets to the console or logfile
tcpdump can output them on the console or to a regular file
i think the winner of the game may be snort, which can output that to lots of format, from binary mode (pretty quick) to database (handy for further processing).

the real question is, what do you want to do with this info... if you write the source and destination IP of every single packet that goes through your firewall, you will have to deal with a _HUGE_ amount of (redundant) info.
Even before talking of processing this info, just writing it to disk will use some ressources and may quickly take lots of disk space if you're not carefull in how you store it and delete it once it's out of date.

You must also be aware that writing to disk is slow, so if you have a too many packets going through, writing all the info may not be possible... as an exemple, you can run tcpdump and generate lots of traffic... you'll see that once stopped, tcpdump tells you how many packets it has captured, how many packets went through and how many were discarded (dropped).

I think you'd better explain what you want to achieve with this info, people might give you better advice.

Anyway, don't misunderstand my post that's definitly doable, the thing is you've got to do it the proper way for what you're after!

Hi

Thanks for all your posts and your time in replying to me.

I have found ethereal software, which seems to beable to do what I am looking for. -

Basically I have to setup PAT and want to be able to check that the packets on the outside of the firewall have the same ip address as the firewalls external interface. Also I need to ensure that computers on the inside of the firewall can simultaneously make connections to the outside world, and that the ip address of these connections is the same, but with different port numbers.

So I am hoping I can use ethereal to do all of this.

If you disagree, or you have a better way, please do let me know as the stuff you posted was very helpful, especially to a newbie like me!

Thanks for your time again

Sam

Sounds like ethereal is the best tool for the job you are trying to do right now. For long term stats gathering I like ntop which you might like to have a look at here