LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 03-06-2006, 07:04 AM   #1
netguy2000
Member
 
Registered: Oct 2003
Location: Karachi, PAKISTAN
Distribution: Redhat, Fedora, Open BSD, FreeBSD, SlackWare
Posts: 115

Rep: Reputation: 15
Question how log mirror port traffic


Hi All,
I have cisco 2950 switch and mirror all ports on one port now I want to log all data of this mirror port on my Linux system, its preferable to log all data in iptables log form so I can user it in some other work too(how to do that)??? . and what ever I do for this all written below.

1. plug mirror port LAN in my eth0 (linux pc ethernet) and try to log packets which hits eth0 through iptables.
iptables -I INPUT -i eth0 -j LOG --log-prefix "MIRROR-PORT"

but nothing happens,
then I try,
iptables -I INPUT -i ! eth1 -j LOG --log-prefix "MIRROR-PORT2"
still short ammount of packets/ bytes log.
tcpdump shows me thousand of traffic on eth0 but iptables logs only 10 to 20 bytes and packets in 5 to 10 min. (what is going wronge)

Plzz help me. its very very important to solve this issue for me, I am tring to do that since 4 days.

Thanks in Advance.
Rizwan.
 
Old 03-07-2006, 06:18 PM   #2
PenguinPwrdBox
Member
 
Registered: Oct 2003
Posts: 568

Rep: Reputation: 31
You are using iptables, which is not intended to do this. iptables is designed to log locally, pertaining to the local machine. By spanning the port, you have placed the machine in the same broadcast domain (you really haven't, but that is how your machine will view it) as the machine on the spanned port. If your interface is running in promiscuous mode, it will ignore the destination MAC address, buffer and process all frames on the wire. iptables, however, will ignore these requests, because the destination IP is not the one that the kernel is running. If you want to log frames on the wire, you should be exploring the use of the very granular filter options with tcpdump, or even better, ethereal (http://ethereal.org)

Last edited by PenguinPwrdBox; 03-07-2006 at 06:20 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
What is the best way to log traffic trough firewall? G-Fox Linux - Networking 3 05-04-2005 01:55 PM
What is the best way to log traffic trough firewall? G-Fox Linux - Security 2 04-28-2005 01:16 PM
What is the best way to log traffic trough firewall? G-Fox Linux - Newbie 6 04-27-2005 08:41 AM
route locally generated traffic to ip:port to localhost:port maenho Linux - Software 2 03-11-2005 04:08 AM
iptables LOG on a Switch Mirror Port Master_D Linux - Networking 0 09-06-2004 04:33 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:24 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration