🚀 go-pugleaf

We're running Dynix on a Sequent S81 and are considering methods of
logging outgoing telnet sessions. We can log which sites connect to
ours (by putting tcp_wrapper between inetd and the server daemons), but
we're trying to determine the best way to log users connections
to other hosts. Frequently, another site might report incidences of
possible hacking from our site and we'd like to know who's doing it.

Some options I've considered:
0. Modifying the kernel. Not possible without the source.
1. Modifying telnet to log sessions. This can be easily circumvented by
 getting the source and recompiling though.
2. Monitoring output from 'netstat' and 'who'. This seems 'kludgy.'
3. Peeking into the kernel. I have very little experience with this and
 am not sure what method to use. I have heard of mmap(), but the manual
 pages are insufficient. Does anyone have an example or a reference?

Thanks in advance,
Lin