Using iptables to log http request to a file?

Discussion in 'Linux Networking' started by xiong.xu.cn, Aug 18, 2006.

  1. xiong.xu.cn

    xiong.xu.cn Guest

    Hi all,

    Can anyone give me pointer to how to log http requset to a file by
    iptables and ulogd?
    Is there any ulogd plugin can parse the traffic and just log the needed
    HTTP request information£¨eg. some http header field£©?
    Some sample source code will be great!

    Thanks in advance!

    Xiong
     
    xiong.xu.cn, Aug 18, 2006
    #1
    1. Advertisements

  2. Without ULOG:
    To match some string
    iptables -A INPUT -p tcp --dport 80 -m string --string "Some String"-j
    ACCEPT

    or better use l7-filter to match some regex:
    put in /etc/l7-protocols/extra/ httpmypatern.pat with content:
    httpmypatern
    some_rexexp.*

    and use
    iptables -A INPUT -p tcp --dport 80 -m layer7 --l7proto httpmypatern -j
    ACCEPT
     
    Viktar Sakovich2038490794, Aug 18, 2006
    #2
    1. Advertisements

  3. xiong.xu.cn

    xiong.xu.cn Guest

    Thank Viktar,

    By using '-j ACCEPT', all the packets matching the pattern will be
    accept? or just the packets matched will be accepted?
    For example, a http request composed of multiple lines, usually 'GET
    ....' followed by other HTTP header lines. In this case, will all the
    http connection traffic be accepted?
    And, which is the better way to parse the matched data and write to log
    in a user defined format?
    Should I use ulogd plugin? Is there any sample show me how to write a
    custom log?

    Thank again,
    Xiong

    Viktar Sakovich2038490794 写�:
     
    xiong.xu.cn, Aug 19, 2006
    #3
  4. In case of -m string only matching packets accepted, but in case of
    l7-filter all packets for conection (l7-filter use conection tracking
    to match next packets of connection) accepted.

    If you want to match for a connection with -m string, do following:
    iptables -A INPUT -p tcp --dport 80 -m string --string "Some String"-j
    CONNMARK --set-mark 0x1
    iptables -A INPUT -m connmark --mark 0x1 -j ACCEPT
     
    Viktar Sakovich2038490794, Aug 19, 2006
    #4
  5. xiong.xu.cn

    imx Guest

    So, how to log just the first few, say 100, packets?

    thx
     
    imx, Aug 20, 2006
    #5
  6. Use connbytes, i. e. something like this:

    iptables -A INPUT -p tcp --dport 80 -m connbytes --connbytes 0:100
    --connbytes-dir both --connbytes-mode packets -j ACCEPT
     
    Viktar Sakovich2038490794, Aug 20, 2006
    #6
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.