2

iptables is as below:

# iptables -t filter -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    1   328 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED 
    0     0 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
  487 49868 LOGGING    all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOGGING (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   39  9426 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 2/min burst 5 LOG flags 0 level 4 prefix `IPTables-Dropped: ' 
  487 49868 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

The number of packets dropped are increasing from INPUT and OUTPUT chain. Is there any way to see the content of these dropped packets? I have tried to workaround tcpdump, but couldn't understand. please someone can help me either with syntax, proper command or tool to see the content of these dropped packages in human readable form.

Here dropped packets are transfered to custome chain LOGGING and at system logs.

 tail -f /var/log/messages
  • Have a look at the NFLOG and ULOG targets. – Hauke Laging Mar 29 '14 at 19:38
1

Tcpdump operates after the filter, so you won't see any incoming packet that is being dropped.

With your rules, the packets are being logged in the kernel logs. With the LOG rule, you get the headers, but not the full content. If you want to log the full content, replace LOG by ULOG (which takes different options, you probably need none except maybe --ulog-prefix) and run the ulogd daemon.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.