Re: [Iptablelog-users] iptables log con fwbuilder

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

There is new code in the cvs repository that uses ulogd to populate the 
database.  I have used it with fwbuilder logs with no problems.

Daniel

GLORIA MARTIN MARTIN wrote:
> 
>     Have you use iptables log anlyzer with de log generated by fwbuilder?
>  
> My log file has lines like this:
>  
> kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8203 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=202 TOS=0x00 PREC=0x00 TTL=128 ID=8204 PROTO=UDP 
> SPT=138 DPT=138 LEN=182
> Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8205 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8206 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8207 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
>  
> So i think the format is not the same that the feed.pl script uses.
>  
>  
> Anyone has done the script for this format?
>  
>  