|author||Phil Sutter <firstname.lastname@example.org>||2018-12-18 12:16:30 +0100|
|committer||Florian Westphal <email@example.com>||2018-12-18 12:50:29 +0100|
extensions: TRACE: Point at xtables-monitor in documentation
With iptables-nft, logging of trace events is different from legacy. Explain why and hint at how to receive events in this case. Signed-off-by: Phil Sutter <firstname.lastname@example.org> Signed-off-by: Florian Westphal <email@example.com>
1 files changed, 14 insertions, 7 deletions
diff --git a/extensions/libxt_TRACE.man b/extensions/libxt_TRACE.man
index 8d590a52..5187a8d2 100644
@@ -1,13 +1,20 @@
This target marks packets so that the kernel will log every rule which match
-the packets as those traverse the tables, chains, rules.
+the packets as those traverse the tables, chains, rules. It can only be used in
-A logging backend, such as ip(6)t_LOG or nfnetlink_log, must be loaded for this
-to be visible.
+With iptables-legacy, a logging backend, such as ip(6)t_LOG or nfnetlink_log,
+must be loaded for this to be visible.
The packets are logged with the string prefix:
"TRACE: tablename:chainname:type:rulenum " where type can be "rule" for
plain rule, "return" for implicit rule at the end of a user defined chain
and "policy" for the policy of the built in chains.
-It can only be used in the
+With iptables-nft, the target is translated into nftables'
+.B "meta nftrace"
+expression. Hence the kernel sends trace events via netlink to userspace where
+they may be displayed using
+.B "xtables-monitor --trace"
+command. For details, refer to
+.BR xtables-monitor (8).