0

I run Ubuntu 16.04

In the linux kernel there are certain log statement for conditions on packet filtering which I'd like to see if they are actually triggered.

One example is:

/* Smaller that minimal TCP header? */
th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
if (th == NULL) {
    if (LOG_INVALID(net, IPPROTO_TCP))
        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
            "nf_ct_tcp: short packet ");
    return -NF_ACCEPT;
}

https://github.com/torvalds/linux/blob/master/net/netfilter/nf_conntrack_proto_tcp.c Line 760

How can I setup my linux system so I can see the nf_log_packet() output somewhere? Perhaps in /var/log/syslog or some other destination.

Where does it get logged? How do I activate logging?

0

So, the following steps worked:

Install Ulog which interfaces with some plugins to capture the kernel logging output

sudo apt install ulog2

Then activate the state INVALID logging by sudo echo "255" > /proc/sys/net/netfilter/nf_conntrack_log_invalid

More documentation on the 255 here: https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt

Set Ulog capture level to debug in: /etc/ulog.conf

Then the log, if you trigger it, will be stored in: /var/log/ulog/syslogemu.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.