|
 |
1dc35b |
From 39808343b03078f992bc5e831ccdd843312f0714 Mon Sep 17 00:00:00 2001
|
|
|
1dc35b |
From: Phil Sutter <phil@nwl.cc>
|
|
|
1dc35b |
Date: Tue, 18 Dec 2018 12:16:30 +0100
|
|
|
1dc35b |
Subject: [PATCH] extensions: TRACE: Point at xtables-monitor in documentation
|
|
|
1dc35b |
|
|
|
1dc35b |
With iptables-nft, logging of trace events is different from legacy.
|
|
|
1dc35b |
Explain why and hint at how to receive events in this case.
|
|
|
1dc35b |
|
|
|
1dc35b |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
1dc35b |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
1dc35b |
(cherry picked from commit 9ac39888722ee9c7e97d9b8cb9eb4f33b582130a)
|
|
|
1dc35b |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
1dc35b |
---
|
|
|
1dc35b |
extensions/libxt_TRACE.man | 21 ++++++++++++++-------
|
|
|
1dc35b |
1 file changed, 14 insertions(+), 7 deletions(-)
|
|
|
1dc35b |
|
|
|
1dc35b |
diff --git a/extensions/libxt_TRACE.man b/extensions/libxt_TRACE.man
|
|
|
1dc35b |
index 8d590a52e26f8..5187a8d22802f 100644
|
|
|
1dc35b |
--- a/extensions/libxt_TRACE.man
|
|
|
1dc35b |
+++ b/extensions/libxt_TRACE.man
|
|
|
1dc35b |
@@ -1,13 +1,20 @@
|
|
|
1dc35b |
This target marks packets so that the kernel will log every rule which match
|
|
|
1dc35b |
-the packets as those traverse the tables, chains, rules.
|
|
|
1dc35b |
+the packets as those traverse the tables, chains, rules. It can only be used in
|
|
|
1dc35b |
+the
|
|
|
1dc35b |
+.BR raw
|
|
|
1dc35b |
+table.
|
|
|
1dc35b |
.PP
|
|
|
1dc35b |
-A logging backend, such as ip(6)t_LOG or nfnetlink_log, must be loaded for this
|
|
|
1dc35b |
-to be visible.
|
|
|
1dc35b |
+With iptables-legacy, a logging backend, such as ip(6)t_LOG or nfnetlink_log,
|
|
|
1dc35b |
+must be loaded for this to be visible.
|
|
|
1dc35b |
The packets are logged with the string prefix:
|
|
|
1dc35b |
"TRACE: tablename:chainname:type:rulenum " where type can be "rule" for
|
|
|
1dc35b |
plain rule, "return" for implicit rule at the end of a user defined chain
|
|
|
1dc35b |
and "policy" for the policy of the built in chains.
|
|
|
1dc35b |
-.br
|
|
|
1dc35b |
-It can only be used in the
|
|
|
1dc35b |
-.BR raw
|
|
|
1dc35b |
-table.
|
|
|
1dc35b |
+.PP
|
|
|
1dc35b |
+With iptables-nft, the target is translated into nftables'
|
|
|
1dc35b |
+.B "meta nftrace"
|
|
|
1dc35b |
+expression. Hence the kernel sends trace events via netlink to userspace where
|
|
|
1dc35b |
+they may be displayed using
|
|
|
1dc35b |
+.B "xtables-monitor --trace"
|
|
|
1dc35b |
+command. For details, refer to
|
|
|
1dc35b |
+.BR xtables-monitor (8).
|
|
|
1dc35b |
--
|
|
|
1dc35b |
2.21.0
|
|
|
1dc35b |
|