# Urgent hint needed! - turn off iptables TRACE logs

## henri

Hi folks,

iptables "kernel: TRACE: filter" log messages are filling up the kern.log and I do not know what causes this behaviour.

The netfilter trace target is build as a module for the kernel...

```
CONFIG_NETFILTER_XT_TARGET_TRACE=m
```

...but it's not loaded!

lsmod:

```

Module                  Size  Used by

nf_conntrack_irc        2331  0 

nf_conntrack_ftp        3988  0 

xt_tcpudp               1587  58 

ipt_LOG                 5198  14 

xt_limit                1004  16 

nf_conntrack_ipv4       7083  65 

nf_defrag_ipv4           771  1 nf_conntrack_ipv4

xt_state                 791  65 

iptable_filter           804  1 

ipt_addrtype            1269  0 

xt_dscp                 1059  0 

xt_string                835  0 

xt_owner                 747  0 

xt_multiport            1162  0 

xt_iprange               980  0 

xt_hashlimit            4174  0 

xt_conntrack            1915  0 

xt_DSCP                 1383  0 

xt_NFQUEUE              1121  0 

xt_mark                  717  0 

xt_connmark             1193  0 

nf_conntrack           37917  6 nf_conntrack_irc,nf_conntrack_ftp,nf_conntrack_ipv4,xt_state,xt_conntrack,xt_connmark

ip_tables               7573  1 iptable_filter

x_tables                8806  18 xt_tcpudp,ipt_LOG,xt_limit,xt_state,iptable_filter,ipt_addrtype,xt_dscp,xt_string,xt_owner,xt_multiport,xt_iprange,xt_hashlimit,xt_conntrack,xt_DSCP,xt_NFQUEUE,xt_mark,xt_connmark,ip_tables

sg                     16438  0 

processor              20265  0 

pcspkr                  1191  0 

button                  3550  0 

thermal_sys             8365  1 processor
```

I use firehol with a pretty simple config but also psad and fail2ban.

May psad initiate the TRACE logs and if so, why is also every answer to an incomming network request traced?

Any Idea what causes the TRACE logs and how to turn them off?

Many thanks for every hint in advance,

    yours HenriLast edited by henri on Wed Jun 15, 2011 11:20 am; edited 1 time in total

----------

## Hu

What is the output of iptables-save -c ; ip6tables-save -c?

----------

## henri

iptables-save -c :

```
*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:in_internet - [0:0]

:in_internet_ICMP_s1 - [0:0]

:in_internet_all_c6 - [0:0]

:in_internet_ftp_c8 - [0:0]

:in_internet_ftp_s2 - [0:0]

:in_internet_http_s3 - [0:0]

:in_internet_https_s4 - [0:0]

:in_internet_irc_c7 - [0:0]

:in_internet_ssh_s5 - [0:0]

:in_intranet - [0:0]

:in_intranet_ICMP_s1 - [0:0]

:in_intranet_all_c8 - [0:0]

:in_intranet_ftp_c10 - [0:0]

:in_intranet_ftp_s2 - [0:0]

:in_intranet_http_s3 - [0:0]

:in_intranet_https_s4 - [0:0]

:in_intranet_irc_c9 - [0:0]

:in_intranet_mysql_s5 - [0:0]

:in_intranet_rsync_s7 - [0:0]

:in_intranet_ssh_s6 - [0:0]

:out_internet - [0:0]

:out_internet_ICMP_s1 - [0:0]

:out_internet_all_c6 - [0:0]

:out_internet_ftp_c8 - [0:0]

:out_internet_ftp_s2 - [0:0]

:out_internet_http_s3 - [0:0]

:out_internet_https_s4 - [0:0]

:out_internet_irc_c7 - [0:0]

:out_internet_ssh_s5 - [0:0]

:out_intranet - [0:0]

:out_intranet_ICMP_s1 - [0:0]

:out_intranet_all_c8 - [0:0]

:out_intranet_ftp_c10 - [0:0]

:out_intranet_ftp_s2 - [0:0]

:out_intranet_http_s3 - [0:0]

:out_intranet_https_s4 - [0:0]

:out_intranet_irc_c9 - [0:0]

:out_intranet_mysql_s5 - [0:0]

:out_intranet_rsync_s7 - [0:0]

:out_intranet_ssh_s6 - [0:0]

:pr_internet_fragments - [0:0]

:pr_internet_icmpflood - [0:0]

:pr_internet_malbad - [0:0]

:pr_internet_malnull - [0:0]

:pr_internet_malxmas - [0:0]

:pr_internet_nosyn - [0:0]

:pr_internet_synflood - [0:0]

[0:0] -A INPUT -i lo -j ACCEPT 

[7110:527428] -A INPUT -d SER.VE.R.IP/32 -i eth0 -j in_internet 

[0:0] -A INPUT -s IN.TRA.NET.IP/16 -d SER.VE.R.IP/32 -i eth0 -j in_intranet 

[0:0] -A INPUT -m state --state RELATED -j ACCEPT 

[0:0] -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "\'IN-unknown:\'" 

[0:0] -A INPUT -j DROP 

[0:0] -A FORWARD -m state --state RELATED -j ACCEPT 

[0:0] -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "\'PASS-unknown:\'" 

[0:0] -A FORWARD -j DROP 

[0:0] -A OUTPUT -o lo -j ACCEPT 

[3596:11235450] -A OUTPUT -s SER.VE.R.IP/32 -o eth0 -j out_internet 

[0:0] -A OUTPUT -s SER.VE.R.IP/32 -d IN.TRA.NET.IP/16 -o eth0 -j out_intranet 

[0:0] -A OUTPUT -m state --state RELATED -j ACCEPT 

[0:0] -A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "\'OUT-unknown:\'" 

[0:0] -A OUTPUT -j DROP 

[0:0] -A in_internet -s IN.TRA.NET.IP/16 -j RETURN 

[0:0] -A in_internet -f -j pr_internet_fragments 

[0:0] -A in_internet -p tcp -m state --state NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j pr_internet_nosyn 

[0:0] -A in_internet -p icmp -m icmp --icmp-type 8 -j pr_internet_icmpflood 

[279:16240] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j pr_internet_synflood 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j pr_internet_malxmas 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j pr_internet_malnull 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j pr_internet_malbad 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j pr_internet_malbad 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j pr_internet_malbad 

[0:0] -A in_internet -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j pr_internet_malbad 

[0:0] -A in_internet -m state --state INVALID -j DROP 

[7110:527428] -A in_internet -j in_internet_ICMP_s1 

[7110:527428] -A in_internet -j in_internet_ftp_s2 

[7110:527428] -A in_internet -j in_internet_http_s3 

[1604:164504] -A in_internet -j in_internet_https_s4 

[732:66529] -A in_internet -j in_internet_ssh_s5 

[21:3369] -A in_internet -j in_internet_all_c6 

[0:0] -A in_internet -j in_internet_irc_c7 

[0:0] -A in_internet -j in_internet_ftp_c8 

[0:0] -A in_internet -m state --state RELATED -j ACCEPT 

[0:0] -A in_internet -m limit --limit 1/sec -j LOG --log-prefix "\'\'IN-internet\':\'" 

[0:0] -A in_internet -j DROP 

[0:0] -A in_internet_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT 

[21:3369] -A in_internet_all_c6 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_c8 -p tcp -m tcp --sport 21 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_c8 -p tcp -m tcp --sport 20 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_c8 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[5506:362924] -A in_internet_http_s3 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT 

[872:97975] -A in_internet_https_s4 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_internet_irc_c7 -p tcp -m tcp --sport 6667 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[711:63160] -A in_internet_ssh_s5 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet -j in_intranet_ICMP_s1 

[0:0] -A in_intranet -j in_intranet_ftp_s2 

[0:0] -A in_intranet -j in_intranet_http_s3 

[0:0] -A in_intranet -j in_intranet_https_s4 

[0:0] -A in_intranet -j in_intranet_mysql_s5 

[0:0] -A in_intranet -j in_intranet_ssh_s6 

[0:0] -A in_intranet -j in_intranet_rsync_s7 

[0:0] -A in_intranet -j in_intranet_all_c8 

[0:0] -A in_intranet -j in_intranet_irc_c9 

[0:0] -A in_intranet -j in_intranet_ftp_c10 

[0:0] -A in_intranet -m state --state RELATED -j ACCEPT 

[0:0] -A in_intranet -m limit --limit 1/sec -j LOG --log-prefix "\'\'IN-intranet\':\'" 

[0:0] -A in_intranet -j DROP 

[0:0] -A in_intranet_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_all_c8 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_c10 -p tcp -m tcp --sport 21 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_c10 -p tcp -m tcp --sport 20 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_c10 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ftp_s2 -p tcp -m tcp --sport 1024:65535 --dport 32768:61000 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_http_s3 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_https_s4 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_irc_c9 -p tcp -m tcp --sport 6667 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_mysql_s5 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_rsync_s7 -p tcp -m tcp --sport 1024:65535 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_rsync_s7 -p udp -m udp --sport 1024:65535 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A in_intranet_ssh_s6 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_internet -d 10.212.0.0/16 -j RETURN 

[3596:11235450] -A out_internet -j out_internet_ICMP_s1 

[3596:11235450] -A out_internet -j out_internet_ftp_s2 

[3596:11235450] -A out_internet -j out_internet_http_s3 

[1100:1676332] -A out_internet -j out_internet_https_s4 

[548:145615] -A out_internet -j out_internet_ssh_s5 

[21:1539] -A out_internet -j out_internet_all_c6 

[0:0] -A out_internet -j out_internet_irc_c7 

[0:0] -A out_internet -j out_internet_ftp_c8 

[0:0] -A out_internet -m state --state RELATED -j ACCEPT 

[0:0] -A out_internet -m limit --limit 1/sec -j LOG --log-prefix "\'\'OUT-internet\':\'" 

[0:0] -A out_internet -j DROP 

[0:0] -A out_internet_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT 

[21:1539] -A out_internet_all_c6 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_c8 -p tcp -m tcp --sport 32768:61000 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_c8 -p tcp -m tcp --sport 32768:61000 --dport 20 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_c8 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_s2 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_s2 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_ftp_s2 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[2496:9559118] -A out_internet_http_s3 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[552:1530717] -A out_internet_https_s4 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_internet_irc_c7 -p tcp -m tcp --sport 32768:61000 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT 

[527:144076] -A out_internet_ssh_s5 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet -j out_intranet_ICMP_s1 

[0:0] -A out_intranet -j out_intranet_ftp_s2 

[0:0] -A out_intranet -j out_intranet_http_s3 

[0:0] -A out_intranet -j out_intranet_https_s4 

[0:0] -A out_intranet -j out_intranet_mysql_s5 

[0:0] -A out_intranet -j out_intranet_ssh_s6 

[0:0] -A out_intranet -j out_intranet_rsync_s7 

[0:0] -A out_intranet -j out_intranet_all_c8 

[0:0] -A out_intranet -j out_intranet_irc_c9 

[0:0] -A out_intranet -j out_intranet_ftp_c10 

[0:0] -A out_intranet -m state --state RELATED -j ACCEPT 

[0:0] -A out_intranet -m limit --limit 1/sec -j LOG --log-prefix "\'\'OUT-intranet\':\'" 

[0:0] -A out_intranet -j DROP 

[0:0] -A out_intranet_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_all_c8 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_c10 -p tcp -m tcp --sport 32768:61000 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_c10 -p tcp -m tcp --sport 32768:61000 --dport 20 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_c10 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_s2 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_s2 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ftp_s2 -p tcp -m tcp --sport 32768:61000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_http_s3 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_https_s4 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_irc_c9 -p tcp -m tcp --sport 32768:61000 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_mysql_s5 -p tcp -m tcp --sport 3306 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_rsync_s7 -p tcp -m tcp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_rsync_s7 -p udp -m udp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A out_intranet_ssh_s6 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

[0:0] -A pr_internet_fragments -m limit --limit 1/sec -j LOG --log-prefix "\'PACKET FRAGMENTS:\'" 

[0:0] -A pr_internet_fragments -j DROP 

[0:0] -A pr_internet_icmpflood -m limit --limit 100/sec --limit-burst 50 -j RETURN 

[0:0] -A pr_internet_icmpflood -m limit --limit 1/sec -j LOG --log-prefix "\'ICMP FLOOD:\'" 

[0:0] -A pr_internet_icmpflood -j DROP 

[0:0] -A pr_internet_malbad -m limit --limit 1/sec -j LOG --log-prefix "\'MALFORMED BAD:\'" 

[0:0] -A pr_internet_malbad -j DROP 

[0:0] -A pr_internet_malnull -m limit --limit 1/sec -j LOG --log-prefix "\'MALFORMED NULL:\'" 

[0:0] -A pr_internet_malnull -j DROP 

[0:0] -A pr_internet_malxmas -m limit --limit 1/sec -j LOG --log-prefix "\'MALFORMED XMAS:\'" 

[0:0] -A pr_internet_malxmas -j DROP 

[0:0] -A pr_internet_nosyn -m limit --limit 1/sec -j LOG --log-prefix "\'NEW TCP w/o SYN:\'" 

[0:0] -A pr_internet_nosyn -j DROP 

[279:16240] -A pr_internet_synflood -m limit --limit 100/sec --limit-burst 50 -j RETURN 

[0:0] -A pr_internet_synflood -m limit --limit 1/sec -j LOG --log-prefix "\'SYN FLOOD:\'" 

[0:0] -A pr_internet_synflood -j DROP 

COMMIT
```

----------

