mjhjmtu

I run Ubuntu 16.04

In the linux kernel there are certain log statement for conditions on packet filtering which I'd like to see if they are actually triggered.

One example is:

/* Smaller that minimal TCP header? */
th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
if (th == NULL) 
 if (LOG_INVALID(net, IPPROTO_TCP))
 nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
 "nf_ct_tcp: short packet ");
 return -NF_ACCEPT;

https://github.com/torvalds/linux/blob/master/net/netfilter/nf_conntrack_proto_tcp.c
Line 760

How can I setup my linux system so I can see the nf_log_packet() output somewhere? Perhaps in /var/log/syslog or some other destination.

Where does it get logged? How do I activate logging?

So, the following steps worked:

Install Ulog which interfaces with some plugins to capture the kernel logging output

sudo apt install ulog2

Then activate the state INVALID logging by
sudo echo "255" > /proc/sys/net/netfilter/nf_conntrack_log_invalid

More documentation on the 255 here:
https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt

Set Ulog capture level to debug in:
/etc/ulog.conf

Then the log, if you trigger it, will be stored in:
/var/log/ulog/syslogemu.log