You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
infidel d53340c76f Sync conflict 3 months ago
__pycache__ Submodule integration success 8 months ago
example Sync conflict 3 months ago
src Plot parsed data done 8 months ago
.gitignore Plot parsed data done 8 months ago
Makefile Parse success, python ctypes struct to library connected 8 months ago
Readme.md Plot parsed data done 8 months ago
iptables.log Truned into ocp-wg-backend module 8 months ago
requirements.txt Plot parsed data done 8 months ago
wrapper.py Submodule integration success 8 months ago

Readme.md

Iptables Log parser

Features

Parse IPtables

...

Plot

  • Plotly ( HTML return )
  • Plotly Dash ( Interactive )

How To

Setup

  1. Enable the custom logging template on /etc/rsyslog.conf as follows.

    template(name="MyIptablesTimestampFormat" type="string" string="tstamp=%timegenerated:::date-rfc3339% %HOSTNAME% %syslogtag% %msg%\n")
    if $msg startswith 'iptables:' then {
        action(type="omfile" file="/var/log/iptables.log" template="MyIptablesTimestampFormat")
        stop
    }
    
  2. Make sure your iptables rules are inline with the condition you use on rsyslog.conf. As example my iptables log file starts with iptables: string so my rsyslog.conf condition is ...startswith 'iptables:'....

    iptables -A FORWARD -s 10.30.1.94/32 -d 192.168.0.0/16 -m limit --limit 1/min -j LOG --log-prefix "iptables: Vsphere "
    iptables -A FORWARD -s 10.30.1.70/32 -d 192.168.0.0/16 -m limit --limit 1/min -j LOG --log-prefix "iptables: RHEL "
    iptables -A FORWARD -s 10.30.1.52/32 -d 192.168.0.0/16 -m limit --limit 1/min -j LOG --log-prefix "iptables: Odoo "
    iptables -A FORWARD -s 10.30.1.105/32 -d 192.168.0.0/16 -m limit --limit 1/min -j LOG --log-prefix "iptables: OPNsense "
    

Build

mkdir lib
#Compile the library
make parse_lib.so

Execute

 ./wrapper.py

Structure

wrapper.py

Reads, iptables.log and calls the lib/parser_lib.so. Feed the parser library with lines from iptables log.

lib/parser_lib.so

Process the sed like operation on the line by line feeded by wrapper.py.

Current parsed values are :

  • TimeStamp
  • Source IP
  • Destination IP
  • Packet Length
  • Interface IN
  • Interface OUT
  • Protocol