---
name: "fwctllog"
section: "1p"
platform: "linux"
package: "fwctl"
version: "0.28-2"
release: "Debian 3.0 (Woody)"
platforms: ["linux"]
url: "https://new.carta.tech/fwctllog"
---

# fwctllog(1p)

Program to gather raw data from the packet dump generated by the firewall

## NAME

fwctllog - Program to gather raw data from the packet dump generated\
 	   by the firewall

## SYNOPSIS

fwtcllog    \[--aliases file\] \[ --interfaces file \] \[--rules file\]\
 	    \[--services-dir dir \]+ \[ --dns ⎪ --nodns \] \[--year year\]\
 	    \[--start date\] \[ --end date ⎪ --period period \]\
 	    logfile ...

## DESCRIPTION

fwctllog reads STDIN or the file named as argument on the command and preprocess the packet logs for convenient later analysis.

## OUTPUT

The program outputs in a pipe (⎪) delimited format the following information.\

- epoch

  The timestamp of the packet in epoch time.\

- policy

  What happened to the logged packet (REJECT,ACCEPT or DENY).\

- device

  The device interface on which the packet was logged.\

- interface

  The *Fwctl*(3) interface name to which this device is releted (ex. EXT).\

- chain

  The name of the chain on which this packet was logged.\

- proto

  The protocol number of the packet.\

- proto\_name

  The protocol name of the packet\

- src\_ip

  The source IP of the packet in IPv4 quad dotted format.\

- src\_host

  The hostname (if dns resolution was turned on and if it was successful) related to the source IP.\

- src\_if

  The *Fwctl*(3) interface which is related to that IP.\

- src\_alias

  The *Fwctl*(3) alias which is related to this IP.\

- src\_port

  The port number of the source if the protocol is TCP or UDP. If the protocol is ICMP, this is the icmp type.\

- src\_serv

  The service name related to the port or the name related to the ICMP type.\

- dst\_ip

  The destination IP of the packet in IPv4 quad dotted format.\

- dst\_host

  The hostname (if dns resolution was turned on and if it was successful) related to the destination IP.\

- dst\_if

  The *Fwctl*(3) interface which is related to that IP.\

- dst\_alias

  The *Fwctl*(3) alias which is related to this IP.\

- dst\_port

  The port number of the destination if the protocol is TCP or UDP. If the protocol is ICMP, this is the icmp code.\

- dst\_serv

  The service name related to the port or the name related to the ICMP code.

## OPTIONS

- aliases

  Specifies the path to the *aliases* file. Default is */etc/fwctl/aliases*.\

- interfaces

  Specifies the path to the *interfaces* file. Default is */etc/fwctl/interfaces*\

- rules

  Specifies the path to the *rules* file. Default is */etc/fwctl/rules*\

- services-dir

  Sets the search patch for service modules. The default is to look in *PERLPATH* and */etc/fwctl/services/*. Using this option removes the last  directory from the search path and adds the directory specified as option. Note that the default perl module path are always searched.

  This option may be specified multiple times.\

- \[no\]dns

  Turn on or off the DNS resolving of found IP.\

- year

  Sets the year that the log starts. Defaults to the current year if the first month of the log is in the past and last year if the logs starts in the future.\

- start

  Sets the date from which to output records. If the Date::Manip module is available you can use any format that this module can understand. If you don't have this module installed, you must specify a complete date of the form YYYY-MM-DD HH:MM:SS The hour, minute and seconds part is optional as well as the year, which can be 2 or 4 digits.\

- end

  Sets the date after which the program stops to output records. If the Date::Manip module is available you can use any format that this module can understand. If that module is not available, you should use the same format that the *start* option.\

- period

  Sets the period length for which to ouput records. It is interpreted relative to the starting date or the start of the logs. If the Date::Manip module is available you can use any format that this module understands. If not use something like Year Month Day Hours Min Secs suffixed each with y,mo,d,h,mi,s. Each part is optional.

## AUTHOR

Francis J. Lacoste \<francis.lacoste@iNsu.COM\>

## COPYRIGHT

Copyright (c) 1999,2000 iNsu Innovations Inc. All rights reserved.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

## SEE ALSO

*Fwctl*(3) *Fwctl::RuleSet*(3) *fwctl*(8).