NAME

       nf2csv - iptables to CSV data

SYNOPSIS

       nf2csv [options]

DESCRIPTION

       nf2csv Parses iptables log messages and generates comma-separate value formatted data.  This is useful to
       provide  input  to  the  AfterGlow project (see http://afterglow.sourceforge.net) so iptables logs can be
       visualized graphically.  An interesting application of nf2csv and AfterGlow is to parse and visualize the
       iptables logfiles made available by the Honeynet project in their Scan  of  the  Month  challenges.   The
       Scan30      and      Scan34      challenges      (see      http://www.honeynet.org/scans/scan30/      and
       http://www.honeynet.org/scans/scan34/)  contain  extensive  iptables   logfiles,   and   some   graphical
       representations  of these can be viewed here: http://www.cipherdyne.org/psad/honeynet/.  The psad program
       also has the ability to generate CSV data from iptables logs with its --CSV mode.

OPTIONS

       -f, --fields <tokens>
              Specify the set of fields that should be printed from iptables log messages. The most common usage
              of this argument is SRC DST DPT to print the source and destination IP addresses, followed by  the
              destination  port  number.  Available fields to print include: SRC, SPT, DST, DPT, PROTO, LEN, IN,
              TOS, TTL, SEQ, ID, TYPE, CODE (and these can also be referred to  as  src,  dst,  sp,  dp,  proto,
              ip_len, intf, tos, and ttl).  There are several additional fields that are not given specific tags
              within iptables log messages, and these can be included by specifying one of the following: flags,
              top_opts,  ip_opts,  chain,  log_prefix,  frag_bit,  src_mac, dst_mac, and udp_len.  Each of these
              fields accepts a search criteria in the form of a numeric comparison, string match, or  IP  match.
              See the EXAMPLES section below for more information.

       -u, --unique-lines
              Only print unique output lines.  This can drastically reduce the output of nf2csv depending on the
              characteristics of the iptables logfile that is being parsed.

       -m, --max-lines <num>
              Specify  the  maximum number of output lines nf2csv will generate.  This is useful for providing a
              limited set of data to AfterGlow in order to make visualizations more clear and less cluttered.

       -r, --regex <regex>
              Specify a regular expression that must match against the entire iptables log message in order  for
              it  to be included within the CSV output.  This allows log messages to be included from the output
              with all of the flexibility of regular expressions.  See  the  EXAMPLES  section  below  for  more
              information.

       -n, --neg-regex <regex>
              Specify  a regular expression that must not match against the iptables log message in order for it
              to be included within the CSV output.  This allows log messages to be  excluded  from  the  output
              with  all  of  the  flexibility  of  regular expressions.  See the EXAMPLES section below for more
              information.

       -s, --start-line <line>
              Specify the starting line where nf2csv begins to process iptables log data.  If you are processing
              a huge file with thousands of iptables log messages this option can be useful to parse a  specific
              chunk of this data.  Also see the --end-line option below.

       -e, --end-line <line>
              Specify the last line of iptables log data that nf2csv will parse.

EXAMPLES

       The  following  examples  illustrate the command line arguments that could be supplied to nf2csv in a few
       situations:

       Print source and destination IP addresses and the destination port number:

       $ nfcsv -f src dst dp

       Same as above, but now require that the source IP come from the 11.11.11.0/24 subnet:

       $ nfcsv -f src:11.11.11.0/24 dst dp

       Display instances of the MyDoom worm:

       $ nfcsv -f src dst dp:3127

       Display packets that have low TTL values:

       $ nfcsv -f src dst ttl:<10

       Display all traffic to or from the host 11.11.11.67 (this sets up an OR condition between the src and dst
       fields):

       $ nfcsv -f src dst dp -r 11.11.11.67

       Display likely instances of Window Messanger popup spam attempts (note the use of the --regex argument to
       require minimal lengths on the UDP length field and source port, but the output contains the  destination
       port of 1026):

       $ nfcsv -f src dst dp -r SPT={4}.*LEN=[4-9]{2}

SEE ALSO

       psad(8)

AUTHOR

       Michael Rash <mbr@cipherdyne.org>

BUGS

       Send bug reports to mbr@cipherdyne.org.  Suggestions and/or comments are always welcome as well.

DISTRIBUTION

       nf2csv  is  distributed  with  the  psad  project (http://www.cipherdyne.org/psad/) under the GNU General
       Public License (GPL), and the latest version may be downloaded from http://www.cipherdyne.org/

Linux                                               Jun, 2006                                          NF2CSV(1)