Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a public network configured using OpenWRT.

How can I log all connections (not the traffic) that flows through the public network?

I need those entries:

  • source MAC
  • source/dest IP
  • time
  • destination hostname if possible
  • source hostname if possible
share|improve this question
    
Just a warning: a single typical page view can result in as many 20 or more individual connections. These logs tend to quickly get unwieldly –  Joel Coehoorn Apr 18 '11 at 16:04

1 Answer 1

You can do this with log rules in the firewall. This will generate a lot of traffic, so you likely want to send the logs to another server. The default logger may truncate the logs so you may want to install another logger like syslog-ng as I documented in OpenWRT syslog-ng Installation. You won't geet the hostnames, as by the time they are being routed they have been converted to IP addresses.

You may want to use Shorewall or Shorewall-lite to generate the firewall for you.

If you are concerned about logging web traffic, then you may want to use Squid or some other proxy which will log all the accesses. Your Open-WRT router likely isn't likely to run it though.

share|improve this answer
    
What about a USB stick, I think that would be sufficient for some traffic. (My WNDR3700 might be even fast enough to do the occasional gzipping.) –  Georg Schölly Apr 18 '11 at 20:13
    
Yes you could try configuring the syslog to write to a USB device. I think syslog doesn't truncate messages locally. It looks like syslog will rotate logs on its own. You may need to compress and rename files if you want to keep them. The logrotate package may help. –  BillThor Apr 18 '11 at 20:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.