Using tcpdump with iptables?
I use iptables to block different kind of attacks on my server. We have a
different set of rules along with different rate-limit rules. Now I also
use a script that would observe the threshold if it were greater than
10mb/s and dump all the packets to a file. This script keeps running all
the time in a screen session and uses the following command to dump:
tcpdump -nn -s0 -c 2000 -w Attack.cap
sleep 300
Once attacked, it waits 5 minutes to check for another attack (sleep 300).
Now I doubt if during the packets capture process, iptables still work
because in /var/messages I see lines like "eth0 entered promiscuous mode"
and "eth0 left promiscuous mode" so it might over-look iptables?
No comments:
Post a Comment