Created attachment 349165 [details]
Patch to /usr/share/logwatch/scripts/services/iptables

Description of problem:
802.1q VLAN subinterfaces have names like eth0.1, eth0.2, eth7.285, etc.  The current version drops the subinterface number.  The attached patch adds the ability to keep the subinterface info.

Version-Release number of selected component (if applicable):
logwatch-7.3.6-42.fc11.noarch

How reproducible:
Always

Steps to Reproduce:
1. Set up a physical interface to be an 802.1q trunk
2. Define some VLAN subinterfaces on the trunk interface
3. Set up netfilter/iptables to log packets on the subinterfaces
4. Run the logwatch iptables service report

Actual results:
All the subinterface traffic is aggregated into the the trunk interface
(see below)

Expected results:
Subinterface traffic info is broken out
(see below)

Additional info:
I'm also submitting this patch upstream.


(Live from my machine) example without the patch:

 --------------------- iptables firewall Begin ------------------------ 

 Listed by source hosts:
 Accepted 6 packets on interface eth0
   From 192.168.1.3 - 3 packets to icmp(8) 
   From 192.168.3.3 - 3 packets to icmp(8) 
 
 Listed by source hosts:
 Dropped 14 packets on interface eth0
   From 192.168.3.3 - 14 packets to udp(53) 
 
 ---------------------- iptables firewall End ------------------------- 


(Live from my machine) example with the patch:

 --------------------- iptables firewall Begin ------------------------ 

 Listed by source hosts:
 Accepted 3 packets on interface eth0.2
   From 192.168.1.3 - 3 packets to icmp(8) 
 
 Listed by source hosts:
 Accepted 3 packets on interface eth0.4
   From 192.168.3.3 - 3 packets to icmp(8) 
 
 Listed by source hosts:
 Dropped 14 packets on interface eth0.4
   From 192.168.3.3 - 14 packets to udp(53) 
 
 ---------------------- iptables firewall End -------------------------