IPPL.CONF(5)

📦
version 1.4.14 · 2 versions
, in debian bookworm, ubuntu jammy, ubuntu noble

✨ NAME ✨

ippl.conf — the IP Protocols Logger configuration file. That's the whole vibe. 💖

And since we're here, this page is IPPL.CONF(5), filed under the File Formats Manual. Bestie, you found the right page. 🎀

🌸 DESCRIPTION 🌸

okay so <pink>ippl.conf</pink> is the only configuration file the ippl logger has. Like, the one. There is no second one. 🙈

It decides two things and two things only:

  • what protocols to log
  • the kind of packets to log

Also, a hash mark (#) — the original page writes it as #'' `` — means that the end of the line is a comment, and so it will not be read. Bye. 💀

🎀 USER RUNNING THREADS 🎀

ngl, ippl does not run the protocol logging threads as root — unless you specifically tell it to. Security reasons, bestie. 🫶

You get to say which user it should use, with the runas keyword.

runas [user]

user is a user defined in /etc/passwd. And by default? The nobody user. Lowkey iconic anonymity. 👑

🦋 PROTOCOLS 🦋

Each protocol is run by a different thread — everybody gets their own little main character moment. To run a thread, use:

run [protocol] [protocol] ...

protocol can be:

  • icmp — run the thread logging ICMP messages.
  • tcp — run the thread logging TCP connections.
  • udp — run the thread logging UDP datagrams.
  • all — log all the protocols. periodt.

🌈 ADDRESS RESOLUTION 🌈

You can enable or disable IP address resolution on a protocol-by-protocol basis. To enable address resolution, use:

resolve [protocol] [protocol] ...

protocol is the same as in the protocols section.

To disable address resolution, use:

noresolve [protocol] [protocol] ...

protocol is the same as before.

By default, IP address resolution is disabled for all the protocols.

ippl does, by default, resolve tcp/udp port numbers to their respective service names. If you pass a protocol to the noportresolve option, ippl logs the port number instead. ✨ This is a Debian specific extension. ✨

By default, service resolving is enabled, since that's the behaviour of the upstream program.

💅 LOGGING FORMAT 💅

ippl can log IP protocols in a more or less detailed format. Default behaviour? It only shows the source address and the type, or the destination port. There's also a more detailed version, and a shortest version too. Options, bestie.

logformat [format] [protocol] [protocol] ...

format can be:

  • short — use a short format for logging.
  • normal — use the normal format. This is the default.
  • detailed — log more information; this option displays the source and destination ports and addresses.

protocol is the same as in the protocols section.

🧚 IDENT MECHANISM 🧚

To enable the IDENT remote username resolution, use the ident keyword. To disable it, use the noident keyword.

⚠️ Heads up bestie: the information returned is NOT reliable in general, because it's returned by the remote host. Do not trust it. fr fr.

By default, ident resolution is off.

🔥 TCP CONNECTION TERMINATION 🔥

ippl can detect when a TCP connection is closed. To enable this feature, use the logclosing keyword. To disable it, use the nologclosing keyword.

By default, TCP connection terminations are ignored.

🌟 LOGGING MECHANISM 🌟

ippl can log messages using syslog (using the LOG_DAEMON facility), or it can write directly into a file. You pick with the log-in keyword.

log-in [protocol] [filename]

protocol is the same as in the protocols section. filename is an absolute path to a file.

🚨 Note that the file cannot be in the root directory; it has to be in a directory.
📌 NOTE: when the logs are rotated, ippl opens new files when it is sent the SIGHUP signal.

👑 RULES 👑

When a thread is run, it catches all the packets using the protocol logged. But maybe you want to ignore certain packets — mood, honestly. That's done with Apache-like rules.

There are two different types of rules. The first one describes what packets to log, and the second one describes the packets that should be ignored. The syntax of a rule is as follows:

[log|ignore] {option [option],[option],...} [protocol] [description]

log means the packets described should be logged, and ignore is used when you don't want to log a certain type of packets.

💫 Option 💫

The option keyword lets you override the default values for this rule only. options is also recognized. ✨

Valid options are:

  • resolve — enable IP address resolution.
  • noresolve — disable IP address resolution.
  • portresolve — enable IP service resolution.
  • noportresolve — disable IP service resolution.
  • ident — use ident logging (only for TCP).
  • noident — disable ident logging (only for TCP).
  • logclosing — log connection termination (only for TCP).
  • nologclosing — do not log connection termination (only for TCP).
  • short — use the short logging format.
  • normal — use the normal logging format.
  • detailed — use the detailed logging format.

🦄 Protocol 🦄

protocol is one of the supported protocols (see the protocols section) — except the all keyword, which is not supported here.

🍓 Description 🍓

description holds the type of packet and the hosts to which the rule applies.

Type of packet:

  • type <number> — specify an ICMP message type.
  • port <number> — specify a destination TCP or UDP port number.
  • port <name> — specify a destination TCP or UDP port name.
  • srcport <number> — specify a source TCP or UDP port number.
  • srcport <name> — specify a source TCP or UDP port name.

number is specified like this:

  • n — number n.
  • n-- — every number m >= n.
  • --n — every number m <= n.
  • l--k — every number m, with l <= m <= k.
  • string — if a string is specified, it is either the name of a service (see /etc/services) or an ICMP message.

Keywords for ICMP messages are:

  • echo_reply — 0
  • dest_unreach — 3
  • src_quench — 4
  • redirect — 5
  • echo_req — 8
  • router_advert — 9
  • router_solicit — 10
  • time_exceeded — 11
  • param_problem — 12
  • ts_req — 13
  • ts_reply — 14
  • info_req — 15
  • info_reply — 16
  • addr_mask_req — 17
  • addr_mask_reply — 18

Source of the packets:

from <host>

where host is specified as follows:

  • x.x.x.x — IP address of a host
  • x.x.x.x/x.x.x.x — IP address, followed by a network mask to specify a subnet
  • x.x.x.x/n — IP address, followed by the number of 1's at the left side of the network mask
  • host.net.domain — host name (wildcards accepted)

Destination of the packets:

to <host>

where host is specified as follows:

  • x.x.x.x — IP address of the local interface
  • host.net.domain — host name of the local interface (no wildcards accepted)

This rule is useful only if you have multiple interfaces connected to your box, or if you use IP aliasing. It can also be useful if you want to log or ignore broadcasts — to do that, just use your broadcast address as destination IP address. 📡

Please note that rules using IP addresses are faster to check than rules using host names.

🚨 If you log UDP, it is strongly recommended to ignore the broadcasts! (until we implement an option for that).

⏰ EXPIRATION OF DNS CACHE ⏰

The time for which ippl holds cached DNS data without performing any queries can be changed.

expire <time>

defines how often the DNS data expires. time is specified in seconds (default is 3600).

📁 FILES 📁

  • /etc/ippl.conf — configuration file
  • /usr/share/doc/ippl/* — files worth reading if you still have a question

🔗 SEE ALSO 🔗

💖 AUTHORS 💖

Hugo Haas (hugo@larve.net) and Etienne Bernard (eb@via.ecp.fr). Absolute legends, we love them. 👑

and that's the whole page, bestie 🫶 this was IPPL.CONF(5), with the last change dated 11 February 2000. now go log some packets 💅✨

📦 where this page comes from