3

I'm trying to find pid of a socket using iptables OUTPUT chain log, or even better adding it into the log.

My current iptable rule:

sudo iptables -A OUTPUT -j LOG --log-prefix='[PID]' --log-level 7 --log-uid

I'm a bit frustrated since I know that iptables' owner module can filter items by pid (using -m owner --owner-pid flag) which means that the info is there, but I can't log it.

I know that it impossible to do with INPUT chain since iptables is a kernel process, but for OUTPUT chain it should be possible.

any idea? or even of how to cross some log data in order to get PID of OUTPUT chain connections?

1
  • 1
    This question is cross-posted there: serverfault.com/questions/1091484/… . Anyway, many owner features were removed since kernel ~ 2.6.something (.25?) . Some documentation on Internet is outdated (eg: this man page web page is wrong today: linux.die.net/man/8/iptables there's still the hint "NOTE: pid, sid and command matching are broken on SMP" )
    – A.B
    Feb 12 at 7:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.