Date: Tue, 12 Sep 2006 16:37:53 -0400 From: Bart Silverstrim <bsilver@chrononomicon.com> To: Chuck Swiger <cswiger@mac.com> Cc: freebsd-questions@freebsd.org, Bill Moran <wmoran@collaborativefusion.com> Subject: Re: forwarding as a gateway, logging certain traffic Message-ID: <CC7F9A36-1D5B-4064-9E55-7D3A2E36CAB5@chrononomicon.com> In-Reply-To: <B7DDE980-7DB8-4AB8-AA85-8FD89638469C@mac.com> References: <7269D41C-C334-44DC-9549-ACB28F79014A@chrononomicon.com> <20060912160830.b7a91061.wmoran@collaborativefusion.com> <B7DDE980-7DB8-4AB8-AA85-8FD89638469C@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sep 12, 2006, at 4:28 PM, Chuck Swiger wrote: > On Sep 12, 2006, at 1:08 PM, Bill Moran wrote: >>> Is there some way to get the FreeBSD system to log machines using >>> port 25 without interfering with the FreeBSD machine's filtering of >>> email function? Or at least make the traffic visible to sniffing >>> with tcpdump or wireshark or ethereal? >> >> Off the top of my head ... >> ipfw add 25 log tcp from any to any 25 >> should work. There are certain kernel configs you have to have in >> place for logging to work, though. > > Better to use something like: > > ipfw add 1 log tcp from any to me 25 setup > > If Bart would like to use tcpdump for the same purpose, consider > running something like: > > tcpdump -nt 'port 25 and (tcp[tcpflags] & tcp-syn != 0)' Maybe my ipfw is old; it kept telling me that "log" is an invalid action. However, I think I may be able to get the tcpdump idea to work. Thanks!
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CC7F9A36-1D5B-4064-9E55-7D3A2E36CAB5>