Packet Logging and Alerting

In this lesson, you will learn how to transition from simply observing firewall logs to creating automated, real-time responses to suspicious network events.

While nftables or iptables can log dropped packets to the kernel ring buffer or syslog, logging alone is passive. To move into automated defense, you must bridge the gap between kernel-level packet events and user-space action.

The Trigger-Action Workflow

The core concept is to use the Netfilter hook system (Concept 19) to identify specific traffic patterns and trigger an external process. Rather than just setting a rule to log, you can use packet tagging and marking (Concept 24) to flag packets that match your criteria.

For example, if you detect a burst of packets originating from a specific source that violates your defined nftables policy, you can mark those packets with a specific value. A user-space daemon, such as ulogd2, can monitor these logs or netlink events and execute a script when the threshold is hit.

Implementation Pattern

Imagine you want to automatically null-route an IP that is scanning your services. You would combine logging with a trigger mechanism:

1. Tag the Event: Use nft to add a rule that logs and marks suspicious traffic.

   # Rule to log and mark suspicious connection attempts
   nft add rule inet filter input tcp dport 22 ct state new log prefix "SSH_ATTEMPT: " meta mark set 0x1
   

2. Monitor the Stream: Use ulogd2 or a custom Python script listening to the nfnetlink_log interface.
3. Execute Response: When the log parser sees the "SSH_ATTEMPT" prefix, it triggers a script to update your nftables set of blocked IPs:

   # Automated response script snippet
   nft add element inet filter blackhole { $OFFENDING_IP }
   

By integrating your logging system directly into an active response loop, you convert a static security rule into a dynamic policy that evolves based on real-time threats. This minimizes the time between detecting a probe and neutralizing the source at the kernel level, effectively automating your incident response.

Key Takeaway: Packet logging becomes a powerful defensive tool when you programmatically feed log triggers back into your kernel firewall to dynamically update policy.