Hi,

I'm using iptables -j LOG to log blocked/throttled connections. These
log entries contain the source and destination MAC addresses... which
will always be the MAC addrs of the single apache box and it's
upstream switch. ;-) Is there any way to tell iptables to *not* log
MAC addresses?

Thanks,

-Jim P.


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

2008/8/25 Jim Popovitch <yahoo@jimpop.com>:
> Hi,
>
> I'm using iptables -j LOG to log blocked/throttled connections. These
> log entries contain the source and destination MAC addresses... which
> will always be the MAC addrs of the single apache box and it's
> upstream switch. ;-) Is there any way to tell iptables to *not* log
> MAC addresses?

You should use argv:

--mac-source !address

Bye,
Stefano

--
http://www.stefanocislaghi.it/


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Mon, Aug 25, 2008 at 4:02 PM, Stefano Cislaghi <s.cislaghi@gmail.com> wrote:
> 2008/8/25 Jim Popovitch <yahoo@jimpop.com>:
>> Hi,
>>
>> I'm using iptables -j LOG to log blocked/throttled connections. These
>> log entries contain the source and destination MAC addresses... which
>> will always be the MAC addrs of the single apache box and it's
>> upstream switch. ;-) Is there any way to tell iptables to *not* log
>> MAC addresses?
>
> You should use argv:
>
> --mac-source !address

:-) Perhaps I wasn't clear enough. I do want the log entries... I
just don't want the log entries to contain the MAC addresses (which
are useless to me because they are the same regardless of where the IP
traffic. The host has 1 interface attached to an upstream Foundry,
so the MACs will always be the same.

-Jim P.


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Jim Popovitch wrote:

On Mon, Aug 25, 2008 at 4:02 PM, Stefano Cislaghi <s.cislaghi@gmail.com> wrote:


2008/8/25 Jim Popovitch <yahoo@jimpop.com>:


Hi,

I'm using iptables -j LOG to log blocked/throttled connections. These
log entries contain the source and destination MAC addresses... which
will always be the MAC addrs of the single apache box and it's
upstream switch. ;-) Is there any way to tell iptables to *not* log
MAC addresses?


You should use argv:

--mac-source !address



:-) Perhaps I wasn't clear enough. I do want the log entries... I
just don't want the log entries to contain the MAC addresses (which
are useless to me because they are the same regardless of where the IP
traffic. The host has 1 interface attached to an upstream Foundry,
so the MACs will always be the same.

-Jim P.



I dont see how to do it with iptables without postprocessing or changing
the source code...

because you don't need all the output from iptables..

Sorry for replying to this thread with another topic; I didn't realize it.

--On August 25, 2008 4:50:17 PM -0400 Jim Popovitch <yahoo@jimpop.com>
wrote:




:-) Perhaps I wasn't clear enough. I do want the log entries... I
just don't want the log entries to contain the MAC addresses (which
are useless to me because they are the same regardless of where the IP
traffic. The host has 1 interface attached to an upstream Foundry,
so the MACs will always be the same.


Take a look at ulogd. ipt_LOG doesn't support any modification of logging
format.




-Jim P.


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org







--
Michael Loftis
Modwest Operations Manager
Powerful, Affordable Web Hosting


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Mon, Aug 25, 2008 at 6:06 PM, Michael Loftis <mloftis@modwest.com> wrote:
> Take a look at ulogd.

Will do. Thanks!

-Jim P.


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Jim Popovitch wrote:



:-) Perhaps I wasn't clear enough. I do want the log entries... I
just don't want the log entries to contain the MAC addresses (which
are useless to me because they are the same regardless of where the IP
traffic. The host has 1 interface attached to an upstream Foundry,
so the MACs will always be the same.


sed and awk may be your true friends here.


-Jim P.


phil


--
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org