Mit Freetz könntest Du auch iptables auf deiner Box installieren (.. wenn deine Box für Freetz&iptables geeignet ist). Wie "robust" iptables beim Loggen dessen was Du willst ist, weiß ich nicht.
Welchen traffic willst Du loggen?
Ja, mit dem richtigen capture filter, geht das.
OK. Dann zusätzliche Frage. Willst Du deinen Besuchern das Ansurfen aller Dports erlaueben, oder evtl. auf Dports 80 und 443 begrenzen?.
Nein, iptables ist oder war nur auf der 7170 & ähnlich (Kernel), so weit ich weiß, instabil.
[B]iplog[/B] is a TCP/IP traffic logger. Currently, it is capable of logging
TCP, UDP and ICMP traffic, though adding support for other protocols
should be relatively easy. iplog contains a built-in packet filter,
allowing for logging or excluding packets that fit a given set of
criteria.
WWW: http://ojnk.sourceforge.net/
Readme: http://ojnk.sourceforge.net/stuff/iplog.readmeroot@fritz:/var/media/ftp/uStor01/external# ./iplog -h
Usage: iplog [options] (Denotes enabled by default)
--user or -u <user|UID> Run as specified the user or UID.
--group or -g <group|GID> Run with specified the group or GID.
--logfile or -l <file> Log to <file>.
--pid-file <file> Use <file> as the pid file.
--ignore or -d Ignore DNS traffic from nameservers listed in
/etc/resolv.conf.
--interface or -i <if0,...,ifN> Listen on the specified interface(s).
--promisc or -a <network> Log traffic to all hosts on <network>.
--kill or -k Kill iplog, if it is running.
--restart or -R Restart iplog, if it is running.
--no-fork or -o Run in the foreground.
--stdout or -L Log to stdout.
--help or -h This help screen.
--version or -v Print version information and exit.
--facility <facility> Use the specified syslog facility.
--priority <priority> Use the specified syslog priority.
--tcp[=true|false|toggle] *Log TCP traffic.
--udp[=true|false|toggle] *Log UDP traffic.
--icmp[=true|false|toggle] *Log ICMP traffic.
--log-ip[=true|false|toggle] or -w Log IP along with hostname.
--log-dest[=true|false|toggle] or -D Log the destination of traffic.
--dns-cache[=true|false|toggle] or -c *Use the built-in DNS cache.
--get-ident[=true|false|toggle] or -e Get ident info on connections
to listening ports.
--tcp-resolve[=true|false|toggle] or -T *Resolve IPs of TCP traffic.
--udp-resolve[=true|false|toggle] or -U *Resolve IPs of UDP traffic.
--icmp-resolve[=true|false|toggle] or -I *Resolve IPs of ICMP traffic.
--disable-resolver or -N Do not resolve any IPs.
--verbose[=true|false|toggle] or -V Be verbose.
--fool-nmap[=true|false|toggle] or -z Fool nmaps OS detection.
--scans-only[=true|false|toggle] or -m Only log scans.
--detect-syn-flood[=true|false|toggle] or -s *Stop resolving IPs if a
SYN flood is detected.
--log-frag[=true|false|toggle] or -y *Log fragment attacks.
--log-traceroute[=true|false|toggle] or -t *Log traceroutes.
--log-ping-flood[=true|false|toggle] or -P *Log ICMP ping floods.
--log-smurf[=true|false|toggle] or -S *Log smurf attacks.
--log-bogus[=true|false|toggle] or -b *Log bogus TCP flags.
--log-portscan[=true|false|toggle] or -p *Log port scans.
--log-udp-scan[=true|false|toggle] or -F *Log UDP scans/floods.
--log-fin-scan[=true|false|toggle] or -f *Log FIN scans.
--log-syn-scan[=true|false|toggle] or -q *Log SYN scans.
--log-xmas-scan[=true|false|toggle] or -x *Log Xmas scans.
--log-null-scan[=true|false|toggle] or -n *Log null scans.root@fritz:/var/mod/root# iplog -odLVwDTs --tcp=true --udp=false -a 0.0.0.0/0 --log-syn-scan=true
Warning: Overriding --logfile
May 29 00:31:56 iplog started.
May 29 00:32:01 TCP: port 80 connection attempt to vserver02.cte.de (85.214.209.234) from 192.168.122.45:52391
May 29 00:32:01 TCP: port 80 connection attempt to vserver02.cte.de (85.214.209.234) from 192.168.122.45:52392
May 29 00:34:28 TCP: port 1720 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 143 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 256 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 993 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 53 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 25 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 1025 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 8888 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: port 3389 connection attempt to fritz.box (192.168.122.1) from 192.168.122.45:62995
May 29 00:34:28 TCP: SYN scan detected to fritz.box (192.168.122.1) [ports 1720,143,256,993,53,25,1025,8888,3389,21,...] from 192.168.122.45 [port 62995]Sollte kein Problem sein. Die iplog.mk-Datei muss ein klein wenig geändert werden.;-)
# ldd ./iplog
libpthread.so.0 => /lib/libpthread.so.0 (0x2aabe000)
[COLOR="red"]libpcap.so.1.1 => /usr/lib/freetz/libpcap.so.1.1[/COLOR] (0x2aae1000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x2ab23000)
libc.so.0 => /lib/libc.so.0 (0x2ab41000)
ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x2aaa8000)# [B][COLOR="red"]find / -iname 'libpcap*'[/COLOR][/B]/var/lib/dpkg/info/libpcap0.8.shlibs
/var/lib/dpkg/info/libpcap0.8.md5sums
/var/lib/dpkg/info/libpcap0.8.postrm
/var/lib/dpkg/info/libpcap0.8.list
/var/lib/dpkg/info/libpcap0.8.postinst
/usr/share/doc/libpcap0.8
/usr/lib/libpcap.so.1.0.0
/usr/lib/libpcap.so.0.8
/home/freetz/freetz-stable-1.2/make/libs/.svn/text-base/libpcap.mk.svn-base
/home/freetz/freetz-stable-1.2/make/libs/libpcap.mk
