Subject: Re: Protocol Loggers
To: None <current-users@netbsd.org>
From: Thilo Manske <Thilo.Manske@HEH.Uni-Oldenburg.DE>
List: current-users
Date: 04/13/1999 13:35:06
On Tue, Apr 13, 1999 at 11:57:09AM +0100, Simon Baker wrote:
> Does anyone know of any good protocol loggers that will compile on NetBSD?
> 
> Logging src ip / port  to dest ip /port, 
> An ability to log all ICMP messages would be nice too...
You can log ICMP (and probably all the other stuff) with NetBSD's
ipf/ipmon:
compile a kernel with
options		IPFILTER_LOG	# ipmon(8) log support
pseudo-device	ipfilter	# IP filter (firewall) and NAT
and maybe something I have forgotten.

add 
block in log proto icmp from any to any
to /etc/ipf.conf (or create it with this line)

set
ipfilter=YES                                    # uses /etc/ipf.conf
ipmon=YES               ipmon_flags="-sn"       # syslog ipfilter messages
in your rc.conf, so that filters are installed and ipmon started on
every boot

and reboot!

Have fun,
  Thilo.
-- 
Dies ist Thilos Unix Signature! Viel Spass damit.