My goal is to use ipset
lists in iptables
to log outbound traffic to certain IP addresses. I intend to monitor an entire network passively.
I have port mirroring enabled and the port mirrored traffic is broadcasting to a server with two network adapters. Eth0 is dedicated to system management and Eth1 operates in promiscuous mode and is dedicated to capturing the traffic passed to it. Is it possible to use iptables
to log outgoing traffic on the network that is being monitored? Thank you.
Best Answer
Have you considered using
tcpdump
rather thaniptables
? Something like:Would dump all packets visible on
eth1
to the file/var/log/packets
. You could later on analyze the file usingtcpdump
,wireshark
, or a variety of other tools.Using
iptables
, you typically log packets using theLOG
target, like this:I'm not sure whether or not
iptables
is the right tool for this job, because (a) I don't know off the top of my head how it will operate with the interface in promiscuous mode, and (b) given high packet rates this form of logging can have a substantial i/o impact on your system.I think you're better off with the
tcpdump
model. The-G
flag totcpdump
will cause it to rotate the capture file periodically, which you'll want to do if you're capturing for an extended period. So something like:This would get you files of the form: