The usual way I know of capturing packets is with iptables/NFLOG/nflog-group and ulogd with libpcap.so built in. It's a simple matter to enable packet capture in the ulogd.conf file and all rules that are hit in iptables are logged into a pcap file.

I'm now using a system with ryslogd instead of ulogd, is there something similar with that? I can't seem to find any documentation about it. Everything is pointing me towards ulogd.

Otherwise, what is the easiest way to get the same functionality without ulogd?

Perhaps I could build the packet capture package and run some process that writes it to a file in the background, tcpdump?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.