Hello,

Is there a way to log all iptables traffic on all the open ports globally? And is there a good iptables log analyzer for kernel 2.6.9.x?
My iptables looks something like below (actually has many more rules):

# Generated by iptables-save v1.2.11 on Tue Mar 13 10:19:38 2007
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32:15731]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibitedCOMMIT
# Completed on Tue Mar 13 10:19:38 2007

You might try Googling 'firewall log monitor' and similar stuff.
I use one called fwlogwatch, which I think I got from Sourceforge.net somewhere. It can be set up to monitor for lots of different firewall/network/iptables messages, and is quite configurable. It logs alerts to a separate log file, and can email or run other scripts upon various events, etc..
I can't really say how "good" it is, but it does the job.

Are you using a firewall, or how are you implementing these iptables rules? Just like with a standalone script? You could use a firewall to do the same job, but that has a logging function built into it; that kinda works hand in hand with the log-watcher. For example, the LutelWall Firewall (I use it) is configurable to the max, uses iptables rules, plus every rule can have a log flag set, so every single event that passes thru the firewall gets logged.

I'm definitely no expert, and there are probably lots of ways to do this, but it's one idea anyhow
good luck!

I would recommend the iptables ULOG target along with the “userspace logging daemon” (ulogd). No use cluttering the kernel log buffer with netfilter messages.

Thanks. we're usin iptables rules. I'll try those suggestions a try.