Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to log destination IP addresses in my Ubuntu router. I have two network cards

eth0 -

eth1 - is the GW for all hosts on my network.

The router works perfectly, but I want to log all destination addresses on outgoing traffic through the router. How can I set this up with iptables? Or is there another way to log this?

share|improve this question
up vote 0 down vote accepted

You would log the traffic with

sudo iptables -I OUTPUT 1 ! -d -j LOG 

Change "" to your netmask

Keep in mind, order is important in iptables, so you may need to put the log in another location or add logs for routing (POSTROUTING), as you wish.

Also keep in mind that this is going to fill your logs. Unless you plan to monitor the logs you may wish to use an alternate method, such as snort (you can configure snort to alert you to certain traffic) or a http proxy (squid if you in a large organization).

You may want to limit your logs

sudo iptables -I OUTPUT 1 ! -d -m limit --limit 5/min -j LOG 

See also

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.