[Ulog-acctd-devel] ulog-prefix, promiscuous mode

[nils toedtmann]

Hi *,

i just started testing accounting via the iptables ULOG target.
The ulog-acctd runs fine yet. Nevertheless, some questions:

* when i use "%r" in the "accounting format", i just get a "r"
  instead of the --ulog-prefix string. Everything else is in
  place, and the ulogd from netfilter.org records it correctly.
  Suggestions?

* in march there was a question for "ulog-acctd success stories".
  I would like to repeat it, as i plan to use it on routers with
  4*100mbit ethernet (not on full load, but definitely >10mbit).
  Any newer experiances with higher bandwidths?

* This question should (and will) go to the netfilter list, but
  maybe somebody here had the same problem: I want to do passive
  accounting in promiscuous mode, but iptables only sees packets
  passing the kernel routing code. Does anybody know a solution
  besides this one (quiet old, did not test it yet):

    
<http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/netfilter.html>

Regards, /nils.

ps: I'm using RH8, latest errata-kernel. ulog-acctd compiled on
a similar system, but with -I/somenewerkernel (as redhat's
kernelheaders lack /usr/include/linux/netfilter_ipv4/ipt_ULOG.h)


--
sig.