Logging & Monitoring

Knowing what hits your firewall is critical.

Logging actions:

iptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH-DROP: "
iptables -A INPUT -p tcp --dport 22 -j DROP

Logged to /var/log/kern.log or syslog.

Volume problem:

• Under attack: millions of log lines per minute.
• Disk fills, syslog drops messages.
• Solutions:
  • Rate limit log: -m limit --limit 1/sec.
  • Sample: log 1 in 1000.
  • Forward to remote syslog (offload).
  • Use ulogd (binary log format, high throughput).

Conntrack monitoring:

conntrack -L                          # list all conns
conntrack -E                          # event stream
cat /proc/sys/net/netfilter/nf_conntrack_count

Counters per rule:

iptables -L INPUT -v -n

Shows packets + bytes hitting each rule.

Useful metrics:

• Packets dropped per rule.
• Top sources (volume + drops).
• Conntrack table fill.
• New conns per second.
• Latency added by firewall.

Monitoring tools:

• iptraf-ng: console traffic monitor.
• darkstat: web-based stats.
• ntopng: deep traffic analysis.
• Prometheus + node_exporter: standard.
• ELK / Graylog: log aggregation.

SIEM:

• Splunk, ELK, Graylog, Sumo Logic.
• Aggregate firewall logs from many devices.
• Correlate across systems.
• Alert on patterns.

Real-time alerting:

• Sustained drop rate above baseline.
• New top sources.
• Unusual destinations.
• Large data exfiltration attempts.

Common dashboards:

• Geo-map of attacker IPs.
• Time series of accept/drop ratios.
• Top services attacked.
• Per-country traffic.

Compliance:

• Logs often legally required (PCI, HIPAA).
• Retention 90 days minimum.
• Tamper-evident storage.