DESCRIPTION
ipmon opens /dev/ipl for reading and awaits data to be saved from the packet filter. The binary data read from the device is reprinted in human readable for, however, IP#’s are not mapped back to hostnames, nor are ports mapped back to service names. The output goes to standard output by default or a filename, if given on the command line. Should the -s option be used, output is instead sent to syslogd(8). Messages sent via syslog have the day, month and year removed from the message, but the time (including microseconds), as recorded in the log, is still included.
Messages generated by ipmon consist of whitespace separated fields. Fields common to all messages are:
1. The date of packet receipt. This is suppressed when the message is sent to syslog.
2. The time of packet receipt. This is in the form HH:MM:SS.F, for hours, minutes seconds, and fractions of a second (which can be several digits long).
3. The name of the interface the packet was processed on, e.g., we1.
4. The group and rule number of the rule, e.g., @0:17. These can be viewed with ipfstat -n.
5. The action: p for passed, b for blocked, for a short packet, n did not match any rules or L for a log rule.
6. The addresses. This is actually three fields: the source address and port (separated by a comma), the -> symbol, and the destination address and port. E.g.: 209.53.17.22,80 -> 198.73.220.17,1722.
7. PR followed by the protocol name or number, e.g., PR tcp.
8. len followed by the header length and total length of the packet, e.g., len 20 40.
If the packet is a TCP packet, there will be an additional field starting with a hyphen followed by letters corresponding to any flags that were set. See the ipf.conf manual page for a list of letters and their flags.
If the packet is an ICMP packet, there will be two fields at the end, the first always being ‘icmp’, and the next being the ICMP message and submessage type, separated by a slash, e.g., icmp 3/3 for a port unreachable message.
In order for ipmon to properly work, the kernel option IPFILTER_LOG must be turned on in your kernel. Please see options(4) for more details.
OPTIONS
