Brian.

Are you wanting a diagnostic tool in Webconfig, and/or perhaps temporarily a how-to for doing this at command line? Are you looking for something that doesn't necessarily log, but just dumps in real-time stats on if packets are being dropped on an interface?

You may run: "iptables -L -v -n"

This would cause a lot less load constraint then say running a real-time logging tool. Logging can quickly slow the entire system and crash a server by making a write to the disk for every packet; and filling up the logs with an entry after entry until it is disabled.

Logging can be done currently using the custom firewall rules module. Going any further with that type or reporting and function can quickly become an overwhelming task however. For this we'd certainly want to see the communities response (i.e. create a new feature request specific to it, or define your wish more here and let's get voting).

For real-time logging that doesn't kill your system, you can use "iptraf". This will tell you if packets are being dropped, but not which rule is causing it.

Hope that helps!