Logovani paketu

[Zbynek Houska]

Dobry den preji,

  poradi mi nekdo jak efektivne logovat pakety, ktere neprojdou firewallem? 

  V rc.d mam:

--snip--

ipmon_enable="YES"
ipmon_flags="-Ds" /var/log/ipflog

--snip--

Pokud spustim portskener tak stejne dostanu tuhle hlasku:

 IPv6 packets:		in 0 out 0
 input packets:		blocked 0 passed 19811 nomatch 16053 counted 0 short
0
output packets:		blocked 0 passed 16342 nomatch 10925 counted 0 short
0
 input packets logged:	blocked 0 passed 0
output packets logged:	blocked 0 passed 0
 packets logged:	input 0 output 0
 log failures:		input 0 output 0
fragment state(in):	kept 0	lost 0
fragment state(out):	kept 0	lost 0
packet state(in):	kept 0	lost 0
packet state(out):	kept 0	lost 0
ICMP replies:	0	TCP RSTs sent:	0
Invalid source(in):	0
Result cache hits(in):	3758	(out):	5417
IN Pullups succeeded:	0	failed:	0
OUT Pullups succeeded:	0	failed:	0
Fastroute successes:	0	failures:	0
TCP cksum fails(in):	0	(out):	0
Packet log flags set: (0)
	none

Ipmon bezi --->   261  ??  Ss     0:00.03 /sbin/ipmon -Ds

Do te dobz nez jsem nastartoval ipmon jako demona tak vse bezelo OK, t.j.
ipfstat ukazovalo blokovane a logovane pakety a pokud jsem spustil ipmon tak
jsem videl i blokovane pakety.

Napada vas neco?

Zbynek