Re: [fwAnalog] Empty output from fwanalog on Debian

From: Hans Steinraht (hsteinraht~AT~openlot.com)
Date: Wed Jul 02 2003 - 09:09:52 CEST



I think it's version 0.5.1 on debian.
I only use -c to be sure that the right fwanalog.opts was used, when I run fwanalog without it the result is the same.

The way iptables log to syslog is like this: Jul 1 12:30:41 bwire-20 kernel: IPT INPUT packet died: IN=eth0 OUT=

MAC=00:01:02:e2:0d:9d:00:30:6e:06:7c:c1:08:00 SRC=193.79.237.39
DST=192.168.3.73 LEN=74 TOS=0x00 PREC=0x00 TTL=246 ID=3718 DF PROTO=UDP
SPT=53 DPT=38863 LEN=54 


This is the output from fwanalog.all.log. What it looks like to do is using a logformat for parsing apaches access.log.
I don't know why because in fwanalog.opts I have set the logformat to iptables.
193.79.237.39 - IPT [2/Jul/2003:08:14:35 +0200] "GET /192.168.3.73/UDP/39030/ HTTP/1.0" 200 74 "http://53/" "00:01:02:e2:0d:9d:00:30:6e:06:7c:c1:08:00" 0 eth0 193.79.237.39 - IPT [2/Jul/2003:08:14:55 +0200] "GET /192.168.3.73/UDP/39031/ HTTP/1.0" 200 74 "http://53/" "00:01:02:e2:0d:9d:00:30:6e:06:7c:c1:08:00" 0 eth0 193.79.237.39 - IPT [2/Jul/2003:08:30:35 +0200] "GET /192.168.3.73/UDP/39032/ HTTP/1.0" 200 74 "http://53/" "00:01:02:e2:0d:9d:00:30:6e:06:7c:c1:08:00" 0 eth0 193.79.237.39 - IPT [2/Jul/2003:08:30:55 +0200] "GET /192.168.3.73/UDP/39033/ HTTP/1.0" 200 74 "http://53/" "00:01:02:e2:0d:9d:00:30:6e:06:7c:c1:08:00" 0 eth0

Hans

On Tue, Jul 01, 2003 at 05:01:09PM +0200, Bal?zs B?r?ny wrote:
> Hello,
>
> * Hans Steinraht <hsteinraht~AT~openlot.com> [2003-07-01 16:14]:
> > Does anyone has any ideas about this.
> Which fwanalog version? AFAIK Debian has a quite old version, and -c is a
> relatively new feature.
>
> Also, could you post (or send me in private e-mail) a few lines from your
> syslog (where the blocked packets are) and from the generated
> fwanalog.all.log?
>
> Regards
> --
> _________________________________________________________________________
> Bal?zs B?r?ny balazs~AT~tud.at http://tud.at ICQ 10747763
>
> A good engineer will make considerable effort to avoid additional effort.

-- 
_________________________
Hans Steinraht
Openlot
Wibautstraat 3
1091 GH Amsterdam
The Netherlands
hsteinraht~AT~openlot.com
Phone:   +3120 596 1840
Fax:     +3120 596 3162
www.openlot.com
_________________________


This archive was generated by hypermail 2.1.5 : Thu Jul 03 2003 - 14:22:03 CEST