iptables log当数据量较大的时候严重占用cpu资源，可以使用iptables nflog扩展配合ulogd收集日志，不占用cpu资源并且支持多种存储后端。
openwrt需安装以下：
opkg install iptables-mod-nflog ulogd ulogd-mod-extra ulogd-mod-nflogulogd配置文件，/etc/ulogd.conf
[global]
logfile="/var/log/ulogd.log"
plugin="/usr/lib/ulogd/ulogd_inppkt_NFLOG.so"
plugin="/usr/lib/ulogd/ulogd_filter_IFINDEX.so"
plugin="/usr/lib/ulogd/ulogd_filter_IP2STR.so"
plugin="/usr/lib/ulogd/ulogd_filter_PRINTPKT.so"
plugin="/usr/lib/ulogd/ulogd_output_LOGEMU.so"
plugin="/usr/lib/ulogd/ulogd_raw2packet_BASE.so"
stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
[log1]
group=1
[emu1]
logfile="/var/log/nflog1.log"
sync=1iptables规则：
iptables -I OUTPUT -p tcp --dport 80 -j NFLOG --nflog-group 1 也可以使用tcpdump监测，查看tcpdump是否支持nflog或nfqueue：
tcpdump -D
5.nflog (Linux netfilter log (NFLOG) interface) [none]
6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]tcpdump -i nflog:1标签：none