iptables log analyzer?

sauce · 12-12-2005, 11:20 PM

I haven't been able to find a "standard" one, or one even worth installing. Does anyone have a favorite? I want it to be able to organize ip traffic into a chart.

Code:

Dec 12 23:28:57 192.168.1.1 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.11 DST=68.150.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=54688 DF PROTO=TCP SPT=1977 DPT=80 SEQ=98805408 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Dec 12 23:28:57 192.168.1.1 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.11 DST=68.150.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=54689 DF PROTO=TCP SPT=1978 DPT=80 SEQ=3951317544 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Dec 12 23:28:57 192.168.1.1 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.11 DST=68.150.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=54766 DF PROTO=TCP SPT=1979 DPT=80 SEQ=3137833515 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Dec 12 23:28:57 192.168.1.1 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.11 DST=68.150.x.x LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=54768 DF PROTO=TCP SPT=1980 DPT=80 SEQ=3330823939 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Dec 12 23:28:57 192.168.1.1 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.11 DST=68.150.x.x LEN=56 TOS=0x00 PREC=0x00 TTL=127 ID=54769 PROTO=UDP SPT=1119 DPT=53 LEN=36

SkyEye · 12-13-2005, 03:39 AM

Try logrep. I was about to try it because it looked great. And lire olso seemed ok.

Before settling for something try a search in FreshMeat. If you search for "iptables log" you'll get good results. Although I suggest you to try the above I currently do not use any iptables log analyzer. So I cannot give my opinion about the versions.