# The Ubuntu Forum Community > Ubuntu Specialised Support > Security > [ubuntu] Iptables log every connection

## pjani

Is there any posible way to log connections i mean time, src address, src port, destination address, destination port with ip tables?

Thankyou.

----------


## lovinglinux

Here is an example to log inbound tcp connections:



```
iptables -A INPUT -p tcp -j LOG --log-prefix ' INPUT TCP ' --log-level 4
```

You should put it in the top of the chain to log all incoming tcp traffic.

----------


## lovinglinux

BTW, I think the easiest way to log all the stuff is to create a new chain:



```
iptables -N INBOUND
```

Then instead of using ACCEPT, redirect all traffic that should be accepted to the INBOUND chain. For example:



```
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED -j INBOUND
```

Then log and accept every connection on the INBOUND chain:



```
iptables -A INBOUND -p tcp -j LOG --log-prefix ' INBOUND TCP ' --log-level 4
iptables -A INBOUND -p tcp -j ACCEPT
```

----------


## The Cog

I guess you only want to log the initial connection rather than every packet. So I would suggest accepting packets on established connections without logging. Something like this:


```
# Create a chain that logs new connections:
iptables -N LOGNEW
iptables -A LOGNEW -j LOG --log-prefix ' INBOUND TCP ' --log-level 4
iptables -A LOGNEW -j ACCEPT
# Accept packets on existing connections without any fuss:
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
# Log incoming packets on new conections:
iptables -A INPUT -p tcp -j LOGNEW
```

----------


## uljanow

```
iptables -I INPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
iptables -I OUTPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
```

 :Wink:

----------


## lensman3

I don't think NEW works for UDP packets.  I think all packets will be logged in the UDP case.  UDP are stateless.  I checked my iptables script and it has UDP packets with a NEW flag.  I'm not sure if the ESTABLISHED path even works for UDP.  All UDP packets may go through the NEW path.

ICMP packets are generally stateless too.

----------


## uljanow

> I don't think NEW works for UDP packets.


Wrong. The state module uses a logical connection layer/abstraction.




```
[ 2134.566659] New Connection: IN= OUT=wlan0 SRC=192.168.178.229 DST=192.168.178.21 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=65094 DF PROTO=UDP SPT=55717 DPT=53 LEN=40
```

----------


## sokol99

uljanow: you da man!  :Smile:

----------


## spezticle

> ```
> iptables -I INPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
> iptables -I OUTPUT -m state --state NEW -j LOG --log-prefix "New Connection: "
> ```


where do these logs go? i tried the command but can't find the log

----------


## spezticle

> where do these logs go? i tried the command but can't find the log


nevermind i figured out where the log is... uh.. now how do i turn it off my log is going to eat my hdd up in a matter of hours.

edit:
i'll figure it out later, i just shutdown the pc for now. i'm going to bed deal with it in the morning.

----------

