Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Mailing lists / fpc-pascal / 2012-01

IPTables log parser?

5 messages · 3 people · –

Reply by email Subscribe to this list Your subscription

Read-only archive. Use j and k to move between messages.

Reinier Olislagers

Hi list,

I noticed ik has started a project to manipulate Linux iptables firewall rules... which got me thinking.

Is there any FreePascal/Delphi code lying around to parse IPtables log output (e.g. in the /var/log/messages syslog file), e.g. into CSV format?

If not, I'll probably write my own... sometime... as I'm interested in importing the stuff into a database using my favourite tool.

Yes, I like reinventing the wheel but:
1. I could use existing suff, e.g. the dshieldpy python project, dshield.py, parse function...
2. Reinventing wheels can be fun and a learning experience...

Thanks,
Reinier

Reply by email

ik
to Reinier Olislagers

On Thu, Jan 19, 2012 at 11:37, Reinier Olislagers <

Show quoted text 10 lines
wrote: Hi list, I noticed ik has started a project to manipulate Linux iptables firewall rules... which got me thinking. Is there any FreePascal/Delphi code lying around to parse IPtables log output (e.g. in the /var/log/messages syslog file), e.g. into CSV format?

Not to my knowledge, but there are ways to get the content inside your program in
realtime and do what you wish from it:
http://netfilter.org/projects/libnetfilter_log/index.html

If you willing in binding it, and add it to my project/

Show quoted text 12 lines
If not, I'll probably write my own... sometime... as I'm interested in importing the stuff into a database using my favourite tool. Yes, I like reinventing the wheel but: 1. I could use existing suff, e.g. the dshieldpy python project, dshield.py, parse function... 2. Reinventing wheels can be fun and a learning experience... Thanks, Reinier

Ido

_______________________________________________ fpc-pascal maillist - http://lists.freepascal.org/mailman/listinfo/fpc-pascal

Reply by email

Mark Morgan Lloyd
to Reinier Olislagers: I noticed ik has started a project to manipulate Linux iptables firewall rules... which…
Reinier Olislagers wrote 7 lines
Hi list, I noticed ik has started a project to manipulate Linux iptables firewall rules... which got me thinking. Is there any FreePascal/Delphi code lying around to parse IPtables log output (e.g. in the /var/log/messages syslog file), e.g. into CSV format?

Not when I last looked, but that wasn't recent. I presume you're aware of logging via ulogd, which at least helps split things out a bit.

One marginally-related thing is visualising iptables' connection tracking using Doomcube, that could be improved enormously using an Elite-style display.

[Grumble] Command-line handling of iptables can be irritating since setting up a rule doesn't give you a unique tag you can use to delete it. I've had a situation in the past where I no longer knew the addresses etc. when it came to tearing a rule down, which caused problems.

Mark Morgan Lloyd markMLl .AT. telemetry.co .DOT. uk [Opinions above are the author's, not those of his employers or colleagues]

Reply by email

Reinier Olislagers
to Mark Morgan Lloyd
Mark Morgan Lloyd wrote 11 lines
Reinier Olislagers wrote: > Hi list, > > I noticed ik has started a project to manipulate Linux iptables firewall > rules... which got me thinking. > > Is there any FreePascal/Delphi code lying around to parse IPtables log > output (e.g. in the /var/log/messages syslog file), e.g. into CSV format? Not when I last looked, but that wasn't recent. I presume you're aware of logging via ulogd, which at least helps split things out a bit.

Thanks, both of you!

Yep, I'm aware of ulogd; however I prefer not installing stuff/tweaking things on my router if I don't have to.

Didn't know about libnetfilter_log; I might indeed have a look at libnetfilter_log to see if I can incorporate that into my FPC program. If I do, I'll get back to you, Ido.

The alternative would be to parse the syslog output which I was thinking about. Though it's not very pretty, the advantage of that is that I can forward my router's syslog to another (database,... whatever) host and run the extraction there...

Thanks,
Reinier

Reply by email

Reinier Olislagers
to ik: On Thu, Jan 19, 2012 at 11:37, Reinier Olislagers < Not to my knowledge, but there are…
ik wrote 8 lines
On Thu, Jan 19, 2012 at 11:37, Reinier Olislagers < > wrote: I noticed ik has started a project to manipulate Linux iptables firewall rules... which got me thinking. Is there any FreePascal/Delphi code lying around to parse IPtables log output (e.g. in the /var/log/messages syslog file), e.g. into CSV format?

I just finished a parser - iptlogtablescsv - in FPC that spits out CSV files (ran it, ironically enough, on Windows).
https://bitbucket.org/reiniero/smalltools/

It seems to work ok and should compile/run on Linux/OSX/FreeBSD.

Bug reports/improvement requests/patches welcome.

Show quoted text 5 lines
Not to my knowledge, but there are ways to get the content inside your program in realtime and do what you wish from it: http://netfilter.org/projects/libnetfilter_log/index.html

I wrote my own parser as I am forwarding firewall events from a router (and possibly other machines in future) to a log host, then parsing the results, so libnetfilter won't work in that situation.

If you willing in binding it, and add it to my project/

If I do get around to it, I'll let you know...

Regards,
Reinier

Reply by email