1

I use Ubuntu to host my web sites. I would like to generate a log of every IP address that "touches" my Ubuntu installation - including ping, port scans, etc, not just http requests. What would be an efficient way to accomplish this task?

0

Network packets can be logged using iptables LOG target. To avoid logging every packet arriving to system, you can use limit and/or conntrack module(s).

LOG target writes messages in kernel log. Syslogd is often configured to write these messages to a log file. These messages can also be viewed with dmesg

It is also possible to use AUDIT target for logging, in which case logs are written to audit log by auditd. When you write a rule with AUDIT target, you need to specify audit record type via --type option.

Example:

  1. Accept packet associated with established connections.

    iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
    
  2. Other packet are logged (with a rate limit). A prefix to be included in log can be set with --log-prefix option.

    iptables -A INPUT -m limit --limit 5/min -j LOG \
             --log-prefix "iptables: " --log-level info
    

Note that iptables rules are evaluated in order. Processing stops at first matching rule to ACCEPT or DROP target. LOG target does not stop processing.

  • Thank you that is exactly what my question requested. I had been trying to avoid going to products I had used in the past like nmap and wireshark. As my server is on a separate network with a static IP, the logged file shouldn't be too overwhelming to process. – Dahere Aug 12 '18 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.