Difference between revisions of "Natlog"
(Created page with "{{Entry |Name=natog |Short description=utility logging connections thru a firewall using source natting |Full description=Natlog is a utility logging traffic through a firewal...") |
m (updated the user level) |
||
| Line 45: | Line 45: | ||
|Version date=2019/04/28 | |Version date=2019/04/28 | ||
|Version status=stable | |Version status=stable | ||
| + | |User level=intermediate | ||
|Accepts cryptocurrency donations=No | |Accepts cryptocurrency donations=No | ||
|OpenPGP public key=http://pgp.surfnet.nl/pks/lookup?op=get&search=0x7DB2A8BEEAE4D8AA | |OpenPGP public key=http://pgp.surfnet.nl/pks/lookup?op=get&search=0x7DB2A8BEEAE4D8AA | ||
Revision as of 05:13, 21 December 2019
natog
https://fbb-git.gitlab.io/natlog/
utility logging connections thru a firewall using source natting
Natlog is a utility logging traffic through a firewall that performs source-NATting (a.k.a. POSTROUTING).
Firewalls like iptables usually offer POSTROUTING source network address translation facilities changing the source address of a host behind the firewall to the address of the host before the firewall.
The standard log facilities provided by iptables do not easily allow us to associate addresses behind the firewall to their source-natted equivalents before the firewall. Natlog was designed to fill in that particular niche.
When running natlog, messages are sent to the syslog daemon and/or to the standard output stream showing the essential characteristics of the connection using source natting. Here is an example:
from Fri 8 22:30:10:55588 until Fri 8 22:40:43:807100: 192.168.19.72:4467 (via: 129.125.90.132:4467) to 200.49.219.180:443
Logs like these allow system administrators to associate, e.g., a complaint arriving for the firewall's IP address (in the example: 129.125.90.132) with a computer behind the firewall (e.g., 192.168.19.72) that actually was responsible for the complaint.
Natlog depends on facilities provided by iptables, but may also generate logs directly using facilities offered by the pcap library.
To create the program from its sources, either descend into the natlog
directory, or unpack a created archive, cd into its top-level directory
and follow the instructions provided in the INSTALL file found there.
Alternatively, binary ready-to-install versions of natlog are available in verious GNU/Linux distributions, in particular Debian. See, e.g., https://packages.debian.org/search?keywords=natlog&searchon=names&suite=all§ion=all
Gitlab's web-pages for natlog are here: https://fbb-git.gitlab.io/natlog/
Download
Categories
Licensing
Leaders and contributors
Resources and communication
Software prerequisites
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the page “GNU Free Documentation License”.
The copyright and license notices on this page only apply to the text on this page. Any software or copyright-licenses or other similar notices described in this text has its own copyright notice and license, which can usually be found in the distribution or license text itself.