LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-14-2007, 01:48 PM   #1
SlowCoder
Senior Member
 
Registered: Oct 2004
Location: Southeast, U.S.A.
Distribution: Debian based
Posts: 1,250

Rep: Reputation: 164Reputation: 164
IPTables logging with domain resolution?


Is there a way to make IPTables resolve the domain name of the destination so that it shows in the logs?
 
Old 11-14-2007, 01:54 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
you really wouldn't want something so critical as iptables doing this, but it'd be easy enough to write a simple script to do a reverse lookup offline as it were.
 
Old 11-15-2007, 11:36 AM   #3
SlowCoder
Senior Member
 
Registered: Oct 2004
Location: Southeast, U.S.A.
Distribution: Debian based
Posts: 1,250

Original Poster
Rep: Reputation: 164Reputation: 164
Ok, I actually knew that ...

How would I go about scripting it? The fundamentals I know I'll have to get are:
- Parse the log file, grabbing the destination IP from each line (DST=xxx.xxx.xxx.xxx), which happens to be the 9th space-separated field.
- Remove the 'DST=' part from the parsed field.
- dig the IP for it's hostname
- Reinsert the hostname into the log.

What utilities should I concentrate on to make this happen?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Need Help w/ logging into win domain (almost there) jrmontg Red Hat 3 11-04-2005 08:35 AM
logging to nt domain hyalevel Linux - Networking 4 04-13-2005 08:32 PM
logging linux onto a windows domain dicom Linux - Networking 1 10-30-2003 12:38 AM
Iptables and logging networks by domain name. mikeyt_333 Linux - Security 1 08-12-2003 05:48 AM
Logging to windows Domain PDC rsekhar03 Linux - General 1 04-25-2003 02:02 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration