IPTables Logging information.

[Harry Hoffman]

You should bear in mind that ports don't equal applications.

A webserver can run on any port you'd like it to.

In order to really know what service/application is being used you'd
need to look at the application layer.

Cheers,
Harry


On Wed, 2008-05-14 at 14:43 +0530, Nirmal Pathak wrote:
> Hi Paul,
> 
> Thanks for reply.
> 
> I think you are right. I tried so google & read few man pages but couldn't
> find what I was looking for.
> So I belive external tools can only help me for this!
> 
> On Wed, May 14, 2008 at 2:27 PM, Paul Malinowski <pmalinowskieu at yahoo.co.uk>
> wrote:
> 
> > Hi Nirmal,
> >
> >  I'm afraid that LOG target is limited, I couldn't even find a way to
> > change logging facility.
> >
> >  It might be a good idea to google for some tool which can do that for
> > you. Alternatively you can use scripting for that purpose.
> >
> >  Please note that in corporate network you have less then a 30 services
> > which are being used.
> >
> >  Kind Regards,
> >  Paul Malinowski
> >
> > Nirmal Pathak <nirmal.pathak at gmail.com> wrote:
> >  Hi,
> >
> > I am looking for something that would indicate the packet type in the log
> > without me having to refer to /etc/services for each entry.
> >
> > An example of what I'd like to see would be:
> >
> > May 5 09:28:58 ws4 kernel: Dropped from INPUT chain IN=eth0 OUT=
> > MAC=ff:ff:ff:ff:ff:ff:00:06:5b:8f:f5:99:08:00 SRC=192.168.251.98 DST=
> > 192.168.251.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=18370 PROTO=UDP
> > SPT=137
> > DPT=137 DPTDESC=NETBIOS Name Service LEN=58
> >
> > In terms of the fictional DPTDESC output, will iptables do something like
> > this?
> >
> 
> Have Fun.
> -- 
> Nirmal D Pathak.
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> I was born free!
> No Gates and Windows can restrict my Freedom!!
> 
> Enjoy Linux!
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~