iptables

pshankland · 03-08-2006, 06:13 AM

How can I view, through SSH, the data going through my iptables firewall? I know this can be done as I have done it before but I am currently having a bit of a mental block!

Thanks.

manya · 03-08-2006, 06:59 AM

Hi

You can use iptstate command..it shows what exactly is happening thorugh IPtables rules

pshankland · 03-08-2006, 07:32 AM

How do I use that?

THanks.

pshankland · 03-13-2006, 04:44 AM

Anybody able to help me with the usage of ipstate?

Thanks.

unSpawn · 03-13-2006, 05:11 AM

Download tool, read man page, try. *Then* ask.

pshankland · 03-13-2006, 05:15 AM

Appear to have ipstate installed as it is located in /dev/ipstate. Problems is when I run /dev/ipstate --help I get Permission Denied error even though I am logged in as root.

I don't think that ipstate is what I am after anyway as I have been able to look at the live data going through the tptables firewall before but simply can't remember how I did it.

BTW - I HAVE looked at google and through this forum for ipstate help but have had no luck in finding anything.

gilead · 03-13-2006, 05:22 AM

Try googling on 'iptables ipstate' - I haven't tried ipstate but these were returned:
http://info.ccone.at/INFO/Mail-Archi.../msg03252.html
http://www.supporting-role.net/softw...tware-list.php

unSpawn · 03-13-2006, 05:38 AM

Appear to have ipstate installed as it is located in /dev/ipstate. Problems is when I run /dev/ipstate --help I get Permission Denied error even though I am logged in as root.
Iptstate is *not* a device. It's an app, here: http://www.phildev.net/iptstate/.

I don't think that ipstate is what I am after anyway as I have been able to look at the live data going through the tptables firewall before but simply can't remember how I did it.
Iptstate provides a "top"-like view of connections and their state and will allow you to sort traffic by criteria. Tailing your firewall log doesn't compare to what you can do with iptstate.

pshankland · 03-13-2006, 06:45 AM

Have installed iptstate but not really what I was after (thanks though).

What I wanted was to see the information as it comes through the firewall and not the 'top' view.

Any other suggestions?

Thanks.

unSpawn · 03-13-2006, 08:10 AM

Well, as I said in my previous post, you could use tail -f /some/system/logfile (usually "messages": check /etc/syslog.conf and provided you have "-j LOG" targets defined in your firewall rules). That'll just provide a stream of loglines w/o any coherence unless you're a speedreader with an optimised mental cache :-]

pshankland · 03-13-2006, 08:57 AM

that was what I was after.

Thanks.