Typing "seawall status" at a shell prompt produces the report shown in the following screenshot.
The upper part of the display is a condensed version of the output of "ipchains -L -n -v" while at the bottom, the last 5 logged packets are displayed.
Typing "seawall monitor" produces continuous output consisting of three different reports. The first report is the condensed version of the output of "ipchains -L -n -v" as shown in the above (note: if you do not have awk installed on the firewall system, the ipchains output will not be as condensed as shown above). The second report consists of the last 20 logged packets. The third display is shown in this screenshot:
The top part of the report shows the output of "ipmasqqdm portfw -ln" while the second shows the contents of /proc/net/ip_masq/autofw. The bottom part of the report is produced by "netstat -nM". If you don't have ipmasqadm installed or if you don't have the autofw module loaded, the first two parts of the report are omitted. If you also don't have /bin/netstat, this third report is omitted entirely.
Each of the three reports is displayed for thirty seconds (can be overridden by passing the delay interval on the command line as in "seawall monitor 10"). You can cause the next report to be displayed immediately by simply pressing the Enter key. If you wish to freeze the display of a particular report, use your current stop character (normally Ctrl-S); when you wish to unfreeze the display, type your current start character (normally Ctrl-Q). You can determine your current start and stop characters by typing "stty -a" at your shell prompt.
Note: On LRP and Coyote, striking the Entry Key has no effect.
When the packet display changes, an audible alarm is sounded.
Beginning in version 4.0, typing "seawall hits" gives a summary of packets logged in the current /var/log/messages file. This feature is thanks to Alex Polishchuk.
This feature is currently not available on LRP and Coyote.
Updated 2/22/2001- Tom Eastep