I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here:
Debugger for Iptables.
From the iptables man for TRACE:
This target marks packes so that the kernel will log every rule which
match the packets as those traverse the tables, chains, rules. (The
ipt_LOG or ip6t_LOG module is required for the logging.) The packets
are logged with the string prefix: "TRACE: tablename:chain-
name:type:rulenum " where type can be "rule" for plain rule, "return"
for implicit rule at the end of a user defined chain and "policy" for
the policy of the built in chains.
It can only be used in the raw table.
I use the following rule: iptables -A PREROUTING -t raw -p tcp -j TRACE but nothing is appended either in /var/log/syslog or /var/log/kern.log!
Is there another step missing? Am I looking in the wrong place?
edit
Even though I can't find log entries, the TRACE target seems to be set up correctly since the packet counters get incremented:
# iptables -L -v -t raw
Chain PREROUTING (policy ACCEPT 193 packets, 63701 bytes)
pkts bytes target prot opt in out source destination
193 63701 TRACE tcp -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 178 packets, 65277 bytes)
pkts bytes target prot opt in out source destination
edit 2
The rule iptables -A PREROUTING -t raw -p tcp -j LOG does print packet information to /var/log/syslog... Why doesn't TRACE work?
