From owner-freebsd-questions@FreeBSD.ORG Tue Sep 12 20:31:01 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AC3E816A407 for ; Tue, 12 Sep 2006 20:31:01 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.183]) by mx1.FreeBSD.org (Postfix) with ESMTP id BA5B243DA9 for ; Tue, 12 Sep 2006 20:29:17 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin08-en2 [10.13.10.153]) by smtpout.mac.com (Xserve/8.12.11/smtpout13/MantshX 4.0) with ESMTP id k8CKSxCS004401; Tue, 12 Sep 2006 13:29:00 -0700 (PDT) Received: from [17.214.13.96] (a17-214-13-96.apple.com [17.214.13.96]) (authenticated bits=0) by mac.com (Xserve/smtpin08/MantshX 4.0) with ESMTP id k8CKSiPK013524; Tue, 12 Sep 2006 13:28:53 -0700 (PDT) In-Reply-To: <20060912160830.b7a91061.wmoran@collaborativefusion.com> References: <7269D41C-C334-44DC-9549-ACB28F79014A@chrononomicon.com> <20060912160830.b7a91061.wmoran@collaborativefusion.com> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Chuck Swiger Date: Tue, 12 Sep 2006 13:28:39 -0700 To: Bill Moran X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAQAAA+k= X-Language-Identified: TRUE Cc: freebsd-questions@freebsd.org, Bart Silverstrim Subject: Re: forwarding as a gateway, logging certain traffic X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Sep 2006 20:31:01 -0000 On Sep 12, 2006, at 1:08 PM, Bill Moran wrote: >> Is there some way to get the FreeBSD system to log machines using >> port 25 without interfering with the FreeBSD machine's filtering of >> email function? Or at least make the traffic visible to sniffing >> with tcpdump or wireshark or ethereal? > > Off the top of my head ... > ipfw add 25 log tcp from any to any 25 > should work. There are certain kernel configs you have to have in > place for logging to work, though. Better to use something like: ipfw add 1 log tcp from any to me 25 setup If Bart would like to use tcpdump for the same purpose, consider running something like: tcpdump -nt 'port 25 and (tcp[tcpflags] & tcp-syn != 0)' -- -Chuck