Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 15 Dec 2009 09:06:04 -0800
From:      Julian Elischer <julian@elischer.org>
To:        Luigi Rizzo <rizzo@iet.unipi.it>
Cc:        "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>, FreeBSD current mailing list <current@freebsd.org>
Subject:   Re: [PATCH] ipfw logging through tcpdump ?
Message-ID:  <4B27C1FC.5030800@elischer.org>
In-Reply-To: <20091215103956.GA14068@onelab2.iet.unipi.it>
References:  <20091214235307.GA5345@onelab2.iet.unipi.it>	<20091215095440.U86040@maildrop.int.zabbadoz.net> <20091215103956.GA14068@onelab2.iet.unipi.it>

next in thread | previous in thread | raw e-mail | index | archive | help
Luigi Rizzo wrote:
> On Tue, Dec 15, 2009 at 10:09:47AM +0000, Bjoern A. Zeeb wrote:
>> On Tue, 15 Dec 2009, Luigi Rizzo wrote:
>>
>> Hi,
>>
>>> The following ipfw patch (which i wrote back in 2001/2002) makes
>>> ipfw logging possible through tcpdump -- it works by passing to the
>>> fake device 'ipfw0' all packets matching rules marked 'log' .
>>> The use is very simple -- to test it just do
>>>
>>> 	ipfw add 100 count log ip from any to any
>>>
>>> and then
>>>
>>> 	tcpdump -ni ipfw0
>>>
>>> will show all matching traffic.
>>>
>>> I think this is a quite convenient and flexible option, so if there
>>> are no objections I plan to commit it to head.
>>
>> pf(4) has pflog(4).   Ideally calling it the same would be good though
>> I wonder if two of the the three of our firewalls grow that feature,
>> if we could have a common packet logging device rather than re-doing
>> it for each implementation.
>>
>> Frankly,  I haven't looked at the details of the implementation but I
>> found getting rul numbers with tcpdump -e etc. was pretty cool to
>> identify where things were blocked or permitted.
> 
> this is something trivial which i have planned already -- stuff
> 10-12 bytes in the MAC header with rule numbers and actions
> is surely trivial.
> 
> Thanks for the pointer to pflog, i'll look at that.
> 
>> Also make sure that the per-VIMAGE interface will work correctly and
>> as expected.
> 
> On this i would like more feedback -- is there anything special
> that I am supposed to do to create per-vimage interfaces ?
> Could you look at the code i sent ?
> "ipfw0" uses the same attach/detach code used by if_tap.


I'm not sure we should do everything just because we can.
it gives us nothing that we can't already get. you can filter using
ipfw netgraph -> netgraph bpf -> ng_socket
you can efficiently capture packets with divert (or tee)
you can write to pcap files using phk's program.


> 
> cheers
> luigi
> 
>> /bz
>>
>> -- 
>> Bjoern A. Zeeb         It will not break if you know what you are doing.
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4B27C1FC.5030800>