Re: [fw1-gurus] log traffic from/to a machine

[Dameon Welch-Abernathy <phoneboy@xxxxxxxxx>]

On Tue, Jan 27, 2009 at 5:49 AM, Andreas Moroder
<andreas.moroder@xxxxxxxxxxxx> wrote:
> Hello,
>
> Is it possible to create such a rule that does nothing but
> loggin and dos not allow or disallow this traffic  or is tcpdump the only
> option ?

In iptables on Linux, the "log" action and the "drop" action are
actually separate rules, so you could do something like this there. In
VPN-1, the action and the log are integrated, which means whatever
rule decides what to do with the packet (acecpt, drop) is the one that
logs it. Your choices end up being:

1. Creating a bunch of rules specific to this IP before other rules to
ensure all activity by this IP is logged.

2. Use something like fw monitor, tcpdump or an external IDS/IPS to
track what that IP does.

-- PhoneBoy
_______________________________________________
fw1-gurus mailing list
fw1-gurus@xxxxxxxxxxxxxxxxxx
http://lists.phoneboy.com/listinfo.cgi/fw1-gurus-phoneboy.com