/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
On Mon, 22 Nov 1999, Gregory Leblanc wrote:
> > Hoping that I need not re-invent the wheel here, does
> > anyone know
> > of a program to monitor current connections through a masquerading
> > machine? I'm looking for something to use that others can see the
> > activity on the machine via web.....
>
> I don't think you can really do this, except for IRC and FTP type
> connections, which are handled through a kernel module. The IP-MASQ
> code is "stateless" which means that it doesn't keep track of "open"
> connections, except for "special" protocols, like FTP etc.
You're partially correct; ipchains and ipfwadm are generally
stateless. They do, however, keep track of enough state to remember which
packets need to get demasqueraded on their way back through.
The ipfwadm/iptables -l/-L -M (and, in fact, "netstat -a -M")
provide a printout of the masquerading table in the kernel.
You're also correct in that the above commands and the script I
provided will _not_ show anything but masqueraded connections; if you have
two boxes talking through the firewall without using masquerading, their
conversations won't show up. Neither will conversations to and from the
box itself.
You have to move up to iptables before you get full stateful
inspection.
Cheers,
- Bill
---------------------------------------------------------------------------
An imperfect plan executed violently is far superior to a perfect
plan.
-- George Patton
(Courtesy of Thomas Roell <[EMAIL PROTECTED]>)
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]). Mason, Buildkernel, named2hosts,
and ipfwadm2ipchains are at: http://www.pobox.com/~wstearns/
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
