nixCraft

HI

How can i view logs?? which i've droped and rejected.
What is the command or configuration?
any help???


Regards
Asim

Asim,

In order to see rejected or dropped packets logs you need to use –LOG module. It will Log network activity to the syslog system i.e. file /var/log/message. See the url for complete info:
http://www.cyberciti.biz/nixcraft/vi...og-message.php

You can also use iptables log
http://sourceforge.net/projects/iptablelog/

If you need more help reply back

Asim,

By default logs of dropped packets goes to /var/log/message. You can use grep, cat, less and other commands to get information. As pointed out by monk you need to use LOG module. Do you need any specific examples?

Here is example from my laptop:
Command:
Output:

Jul 7 17:15:09 debian kernel: IN=eth0 OUT= MAC=00:0f:ea:91:04:07:00:08:5c:00:00:01:08:00 SRC=218.52.60.50 DST=192.168.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=33736 DF PROTO=TCP SPT=57797 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 7 17:15:12 debian kernel: IN=eth0 OUT= MAC=00:0f:ea:91:04:07:00:08:5c:00:00:01:08:00 SRC=218.52.60.50 DST=192.168.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=33738 DF PROTO=TCP SPT=57797 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
Jul 7 17:16:03 debian kernel: IN=eth0 OUT= MAC=00:0f:ea:91:04:07:00:08:5c:00:00:01:08:00 SRC=66.111.241.4 DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=15270 PROTO=TCP SPT=8477 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0

As you see IP 66.111.241.4 and 218.52.60.50 are dropped by my iptables. They are trying to connect DPT=22 (ssh server).

Hope this helps.

Thanks buddies