iptables log and node names

Ammad · 09-04-2009, 04:55 AM

HI,

Using iptables to log each packet is cool to analyze.
i have done this to store logs in seperate file, but for addition how do i get hostnames/FQDN of local nodes instead of IP address. i have dns on firewall system for all dynamic dhcp nodes. since logs are also useful to get history of nodes and its details.

so how do i set this to store fqdn in logs insted of IP address?

thanks.

acid_kewpie · 09-05-2009, 01:31 AM

you seriously don't want your firewall to directly do reverse DNS lookups do you?? That'll add huge amounts of latency to the system, horrible. If you wish to do it offline, then it's easy enough to hack out an ip from a log and pass it through "host" to get a PTR record. This really needs to be a different offline process.

Ammad · 09-05-2009, 01:34 AM

Is there any other tool for to change ip address to fqdn ?

thanks.

estabroo · 09-05-2009, 07:39 AM

host, dig, whois

Ammad · 09-05-2009, 08:09 PM

i think need to have script to update firewall log to add hostnames/fqdn at the end of day .