Log ALL dropped packets

[--JayJay--]

Running Asuswrt by Merlin version 380.64.
Dropped packets are logged in syslog.
From the log I get impression not all dropped packtes are logged.

Can this be confirmed?
Which are loged and which not....?
And if confirmed, how could all dropped packets be logged?
When logging all dropped packets is impacting performance too much how can logging granularity be improved without impact on performance?

 

[redhat27]

Do you have a custom /jffs/scripts/firewall-start script?
If yes, do you have -j DROP entries there?
If yes, then all your firewall dropped packets are not logged.

What you can do, is change the -j DROP to -j logdrop within this context:

if [ X"`nvram get fw_log_x`" = X"drop" ] || [ X"`nvram get fw_log_x`" = X"both" ]; then
...{put all your rules with -j DROP here changing them to -j logdrop}...
fi

When logging all dropped packets is impacting performance too much how can logging granularity be improved without impact on performance?

When you enable logging of dropped packets, usually there is too much logging in syslog, as your router is constantly hit from all sorts of traffic from outside. If you are not using the DROPped info in some other way, I would suggest disabling FW logging. They will still be dropped, they will just not get logged.

 

[--JayJay--]

Do you have a custom /jffs/scripts/firewall-start script?
If yes, do you have -j DROP entries there?
If yes, then all your firewall dropped packets are not logged.

What you can do, is change the -j DROP to -j logdrop within this context:

if [ X"`nvram get fw_log_x`" = X"drop" ] || [ X"`nvram get fw_log_x`" = X"both" ]; then
...{put all your rules with -j DROP here changing them to -j logdrop}...
fi

There are scripts in /jffs/scripts/ but none named firewall-start.
Mine are these three: post-mount, services-start and services-stop.

 

[redhat27]

Unless you have iptables rules in the scripts you mentioned, I do not see why you'd have DROPped packets that are not logged. Why do you suspect that they are not logged?