Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a public network configured using OpenWRT.

How can I log all connections (not the traffic) that flows through the public network?

I need those entries:

  • source MAC
  • source/dest IP
  • time
  • destination hostname if possible
  • source hostname if possible
share|improve this question
Just a warning: a single typical page view can result in as many 20 or more individual connections. These logs tend to quickly get unwieldly – Joel Coehoorn Apr 18 '11 at 16:04

You can do this with log rules in the firewall. This will generate a lot of traffic, so you likely want to send the logs to another server. The default logger may truncate the logs so you may want to install another logger like syslog-ng as I documented in OpenWRT syslog-ng Installation. You won't geet the hostnames, as by the time they are being routed they have been converted to IP addresses.

You may want to use Shorewall or Shorewall-lite to generate the firewall for you.

If you are concerned about logging web traffic, then you may want to use Squid or some other proxy which will log all the accesses. Your Open-WRT router likely isn't likely to run it though.

share|improve this answer
What about a USB stick, I think that would be sufficient for some traffic. (My WNDR3700 might be even fast enough to do the occasional gzipping.) – Georg Schölly Apr 18 '11 at 20:13
Yes you could try configuring the syslog to write to a USB device. I think syslog doesn't truncate messages locally. It looks like syslog will rotate logs on its own. You may need to compress and rename files if you want to keep them. The logrotate package may help. – BillThor Apr 18 '11 at 20:25

ssh into router

logread | grep -A 10 authenticated

Wed Jun  3 21:15:20 2015 hostapd: wlan0: STA e0:xx:xx:xx:xx:xx IEEE 802.11: authenticated
Wed Jun  3 21:15:20 2015 hostapd: wlan0: STA e0:xx:xx:xx:xx:xx IEEE 802.11: associated (aid 1)
Wed Jun  3 21:15:20 2015 hostapd: wlan0: STA DHCPREQUEST(br-lan) e0:xx:xx:xx:xx:xx

Figure out how to send to remote server using logread -r or syslog-ng ( )

See also:

share|improve this answer
Thank you for your answer. Unfortunately I was interested in all connections traversing the router, not only SSH. – Georg Schölly Jun 4 '15 at 13:20
Hi @GeorgSchölly -- The example shows a DHCP request, including three of your goals, 1) source MAC 2) source/dest IP 3) time By customizing the related tools via ssh, you should be able to fully comtomize the logging output. In my case, I was having a hard time correlating ip addresses and mac addresses. Due to the short term nature of the logread buffer, this type of setup still requires some additional work if not actively monitoring. – here Jun 9 '15 at 5:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .