Ip accounting Help

Ip accounting Help

[Joel]

Hi all,

Currently I am working on Ip accounting in linux.
My system is Redhat 9.0 with iptables v1.2.7a
This redhat is doing Squid-Caching/ Nat/ Bandwidth management with tc/
Real ip forwarding.

I want to do Ip accounting of upload and download. I want to know how
much per ip bandwidth consumption is ? 

As i m doing source nat and Real ip forwarding, FORWARD chain will have
bytes counters. So FORWARD chain will give the correct figure of how
much the ip has used the bandwidth ???

I dont want to create new chain, I want to collect the data from
INPUT/OUTPUT/FORWARD chains if that are accurate.

Awaiting for help..
Excuse me for my English.

Joel n.solanki
Systems Administrator
D2V ISP PVT LTD.
(M) 91-9825500258

Re: Ip accounting Help

[Antony Stone]

On Wednesday 23 June 2004 4:49 am, Joel wrote:

> Hi all,
>
> Currently I am working on Ip accounting in linux.
> My system is Redhat 9.0 with iptables v1.2.7a
> This redhat is doing Squid-Caching/ Nat/ Bandwidth management with tc/
> Real ip forwarding.
>
> I want to do Ip accounting of upload and download. I want to know how
> much per ip bandwidth consumption is ?
>
> As i m doing source nat and Real ip forwarding, FORWARD chain will have
> bytes counters. So FORWARD chain will give the correct figure of how
> much the ip has used the bandwidth ???

Beware of trying to do this if you are using the stateful connection tracking 
of netfilter (iptables -I FORWARD -m state --state ESTABLISHED,RELATED), 
because if you are, then almost all of the packets going through the machine 
(specifically, all except the first one of each connection) will be processed 
by this one rule, and all the other rules in the FORWARD chain will only see 
one packet per connection (the first one).

You may be able to do what you want using the mangle table of the FORWARD 
chain, but not with the default filter table.

Regards,

Antony.

-- 
I own three Windows books, published by O'Reilly.   They are "Windows 
Annoyances", "Office 97 Annoyances" and "Windows 98 Annoyances".   That 
pretty much sums it up for me.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Ip accounting Help

[Dharmendra T.]

hi Joel,

 There are lot of packages available on the net for ip accounting. Just
choose for yours.

Regards,

Dharmendra T.
Linux Security and Admin,
www.nsecure.net

This message is intended for the addressee only. It may contain privileged or confidential information. If you have received
 this message in error, please notify the sender and destroy the message immediately. Unauthorised use or reproduction of 
this message is strictly prohibited.

On Wed, 2004-06-23 at 09:19, Joel wrote:
> Hi all,
> 
> Currently I am working on Ip accounting in linux.
> My system is Redhat 9.0 with iptables v1.2.7a
> This redhat is doing Squid-Caching/ Nat/ Bandwidth management with tc/
> Real ip forwarding.
> 
> I want to do Ip accounting of upload and download. I want to know how
> much per ip bandwidth consumption is ? 
> 
> As i m doing source nat and Real ip forwarding, FORWARD chain will have
> bytes counters. So FORWARD chain will give the correct figure of how
> much the ip has used the bandwidth ???
> 
> I dont want to create new chain, I want to collect the data from
> INPUT/OUTPUT/FORWARD chains if that are accurate.
> 
> Awaiting for help..
> Excuse me for my English.
> 
> Joel n.solanki
> Systems Administrator
> D2V ISP PVT LTD.
> (M) 91-9825500258
> 
> 
> 

-- 

Re: Ip accounting Help

[Joel]

On Wed, 2004-06-23 at 14:31, Antony Stone wrote:
> On Wednesday 23 June 2004 4:49 am, Joel wrote:
> 
> > Hi all,
> >
> > Currently I am working on Ip accounting in linux.
> > My system is Redhat 9.0 with iptables v1.2.7a
> > This redhat is doing Squid-Caching/ Nat/ Bandwidth management with tc/
> > Real ip forwarding.
> >
> > I want to do Ip accounting of upload and download. I want to know how
> > much per ip bandwidth consumption is ?
> >
> > As i m doing source nat and Real ip forwarding, FORWARD chain will have
> > bytes counters. So FORWARD chain will give the correct figure of how
> > much the ip has used the bandwidth ???
> 
> Beware of trying to do this if you are using the stateful connection tracking 
> of netfilter (iptables -I FORWARD -m state --state ESTABLISHED,RELATED), 
> because if you are, then almost all of the packets going through the machine 
> (specifically, all except the first one of each connection) will be processed 
> by this one rule, and all the other rules in the FORWARD chain will only see 
> one packet per connection (the first one).
> 
> You may be able to do what you want using the mangle table of the FORWARD 
> chain, but not with the default filter table.
> 
> Regards,
> 
> Antony.
-- 


Hi Antony,

Yes I am using stateful connection tracking of netfilter ( iptables -I FORWARD -m state --state ESTABLISHED,RELATED)
So as per you i have used FORWARD chain in MANGLE table like this.

# iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT  ---> I think for Download traffic  ---> M I right ?
# iptables -t mangle -i eth0 -A FORWARD -d 10.1.1.24/29 -j ACCEPT  ---> I think for Upload traffic ----> M I right ?

This is the output of 
# iptables -t mangle -nvL FORWARD

Chain FORWARD (policy ACCEPT 1747K packets, 318M bytes)
 pkts bytes target     prot opt in     out     source               destination
 1068 91499 ACCEPT     all  --  eth1   *       10.1.1.24/29         0.0.0.0/0
  148 26923 ACCEPT     all  --  eth0   *       0.0.0.0/0            10.1.1.24/29

Antony i have lot of other ip address but i have created only this subnet for mangle table for testing.
Traffic bytes are passing through this.
So is the correct method ?
Will be the bytes over here are accurate ???

Thanking you,

Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com/

Re: Ip accounting Help

[Antony Stone]

On Wednesday 23 June 2004 11:57 am, Joel wrote:

> On Wed, 2004-06-23 at 14:31, Antony Stone wrote:
> >
> > Beware of trying to do this if you are using the stateful connection
> > tracking of netfilter (iptables -I FORWARD -m state --state
> > ESTABLISHED,RELATED), because if you are, then almost all of the packets
> > going through the machine (specifically, all except the first one of each
> > connection) will be processed by this one rule, and all the other rules
> > in the FORWARD chain will only see one packet per connection (the first
> > one).
> >
> > You may be able to do what you want using the mangle table of the FORWARD
> > chain, but not with the default filter table.
>
> Yes I am using stateful connection tracking of netfilter ( iptables -I
> FORWARD -m state --state ESTABLISHED,RELATED)
> So as per you i have used FORWARD chain in MANGLE table like this.
>
> # iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT  ---> I
> think for Download traffic  ---> M I right ?
> # iptables -t mangle -i eth0 -A FORWARD -d 10.1.1.24/29 -j ACCEPT  ---> I
> think for Upload traffic ----> M I right ?
>
> This is the output of 
> # iptables -t mangle -nvL FORWARD
>
> Chain FORWARD (policy ACCEPT 1747K packets, 318M bytes)
>  pkts bytes target     prot opt in     out     source             
> destination
> 1068 91499 ACCEPT     all  --  eth1   *       10.1.1.24/29         0.0.0.0/0
>  148 26923 ACCEPT     all  --  eth0   *       0.0.0.0/0           
> 10.1.1.24/29
>
> Antony i have lot of other ip address but i have created only this subnet
> for mangle table for testing.
> Traffic bytes are passing through this.
> So is the correct method ?
> Will be the bytes over here are accurate ???

The byte counts will be accurate, yes, and you have the correct idea about 
using -s a.b.c.d and -d w.x.y.z to capture traffic to and from particular IP 
addresses.

The thing I suggest you change, though, is not to have a -j ACCEPT at the end 
of your rules - just let all the packets flow right through the mangle table, 
with the rules simply counting them as they go past.

In other words, don't do:

iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT

Just do:

iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29

The packets will still get counted just the same.

The reason for this advice is that the filter table is for filtering; the nat 
and mangle tables are not.   Therefore you shouldn't use targets like ACCEPT, 
DROP, etc (which are filtering operations) anywhere except the filter tables.

Regards,

Antony.

-- 
I want to build a machine that will be proud of me.

 - Danny Hillis, creator of The Connection Machine

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Ip accounting Help

[Joel Solanki]

Thanks Antony...
I am working on this according to what you suggested.

-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com


On Wed, 2004-06-23 at 17:11, Antony Stone wrote:
> On Wednesday 23 June 2004 11:57 am, Joel wrote:
> 
> > On Wed, 2004-06-23 at 14:31, Antony Stone wrote:
> > >
> > > Beware of trying to do this if you are using the stateful connection
> > > tracking of netfilter (iptables -I FORWARD -m state --state
> > > ESTABLISHED,RELATED), because if you are, then almost all of the packets
> > > going through the machine (specifically, all except the first one of each
> > > connection) will be processed by this one rule, and all the other rules
> > > in the FORWARD chain will only see one packet per connection (the first
> > > one).
> > >
> > > You may be able to do what you want using the mangle table of the FORWARD
> > > chain, but not with the default filter table.
> >
> > Yes I am using stateful connection tracking of netfilter ( iptables -I
> > FORWARD -m state --state ESTABLISHED,RELATED)
> > So as per you i have used FORWARD chain in MANGLE table like this.
> >
> > # iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Download traffic  ---> M I right ?
> > # iptables -t mangle -i eth0 -A FORWARD -d 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Upload traffic ----> M I right ?
> >
> > This is the output of 
> > # iptables -t mangle -nvL FORWARD
> >
> > Chain FORWARD (policy ACCEPT 1747K packets, 318M bytes)
> >  pkts bytes target     prot opt in     out     source             
> > destination
> > 1068 91499 ACCEPT     all  --  eth1   *       10.1.1.24/29         0.0.0.0/0
> >  148 26923 ACCEPT     all  --  eth0   *       0.0.0.0/0           
> > 10.1.1.24/29
> >
> > Antony i have lot of other ip address but i have created only this subnet
> > for mangle table for testing.
> > Traffic bytes are passing through this.
> > So is the correct method ?
> > Will be the bytes over here are accurate ???
> 
> The byte counts will be accurate, yes, and you have the correct idea about 
> using -s a.b.c.d and -d w.x.y.z to capture traffic to and from particular IP 
> addresses.
> 
> The thing I suggest you change, though, is not to have a -j ACCEPT at the end 
> of your rules - just let all the packets flow right through the mangle table, 
> with the rules simply counting them as they go past.
> 
> In other words, don't do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT
> 
> Just do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29
> 
> The packets will still get counted just the same.
> 
> The reason for this advice is that the filter table is for filtering; the nat 
> and mangle tables are not.   Therefore you shouldn't use targets like ACCEPT, 
> DROP, etc (which are filtering operations) anywhere except the filter tables.
> 
> Regards,
> 
> Antony.

Re: Ip accounting Help

[Joel Solanki]

On Wed, 2004-06-23 at 17:11, Antony Stone wrote:
> On Wednesday 23 June 2004 11:57 am, Joel wrote:
> 
> > On Wed, 2004-06-23 at 14:31, Antony Stone wrote:
> > >
> > > Beware of trying to do this if you are using the stateful connection
> > > tracking of netfilter (iptables -I FORWARD -m state --state
> > > ESTABLISHED,RELATED), because if you are, then almost all of the packets
> > > going through the machine (specifically, all except the first one of each
> > > connection) will be processed by this one rule, and all the other rules
> > > in the FORWARD chain will only see one packet per connection (the first
> > > one).
> > >
> > > You may be able to do what you want using the mangle table of the FORWARD
> > > chain, but not with the default filter table.
> >
> > Yes I am using stateful connection tracking of netfilter ( iptables -I
> > FORWARD -m state --state ESTABLISHED,RELATED)
> > So as per you i have used FORWARD chain in MANGLE table like this.
> >
> > # iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Download traffic  ---> M I right ?
> > # iptables -t mangle -i eth0 -A FORWARD -d 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Upload traffic ----> M I right ?
> >
> > This is the output of 
> > # iptables -t mangle -nvL FORWARD
> >
> > Chain FORWARD (policy ACCEPT 1747K packets, 318M bytes)
> >  pkts bytes target     prot opt in     out     source             
> > destination
> > 1068 91499 ACCEPT     all  --  eth1   *       10.1.1.24/29         0.0.0.0/0
> >  148 26923 ACCEPT     all  --  eth0   *       0.0.0.0/0           
> > 10.1.1.24/29
> >
> > Antony i have lot of other ip address but i have created only this subnet
> > for mangle table for testing.
> > Traffic bytes are passing through this.
> > So is the correct method ?
> > Will be the bytes over here are accurate ???
> 
> The byte counts will be accurate, yes, and you have the correct idea about 
> using -s a.b.c.d and -d w.x.y.z to capture traffic to and from particular IP 
> addresses.
> 
> The thing I suggest you change, though, is not to have a -j ACCEPT at the end 
> of your rules - just let all the packets flow right through the mangle table, 
> with the rules simply counting them as they go past.
> 
> In other words, don't do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT
> 
> Just do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29
> 
> The packets will still get counted just the same.
> 
> The reason for this advice is that the filter table is for filtering; the nat 
> and mangle tables are not.   Therefore you shouldn't use targets like ACCEPT, 
> DROP, etc (which are filtering operations) anywhere except the filter tables.
> 
> Regards,
> 
> Antony.

Hi antony,

I have done some R&D on this on my production server.

I have given this commands on the server.

# $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
# $IPT -t mangle -o eth1 -A FORWARD -d 192.168.0.2

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source        destination
    0     0            all  --  eth1   *       192.168.0.2     0.0.0.0/0
    0     0            all  --  *      eth1    0.0.0.0/0     192.168.0.2

		AND 

# $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
# $IPT -t mangle -o eth0 -A FORWARD -d 192.168.0.2


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source        destination
    0     0            all  --  eth1   *       192.168.0.2    0.0.0.0/0
    0     0            all  --  *      eth0    0.0.0.0/0     192.168.0.2



Right now there are no bytes counter in above both scenario coz i have
restarted my production server.

I can get the dowload bytes counters perfectly in the $IPT -t mangle -i
eth1 -A FORWARD -s 192.168.0.2 command. From this command i can measure
the download bytes.

How do i measure the upload bytes ..?
what will be the command.
I tried the above commands but its not working appropiate.
Where i have gone wrong...?

Regards,
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com

Re: Ip accounting Help--> Urgent

[Joel Solanki]

Hello all, ANTONY ...hoping something from u :)

I am testing ip accounting on my production server for last 2 days but i
can sort the things. Any body if u could throw little light that would
be really helpful to me.
This is my testing results.

# $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
# $IPT -t mangle -o eth0 -A FORWARD -d 192.168.0.2

Results:-

Chain FORWARD (policy ACCEPT 6853 packets, 2981K bytes)
 pkts bytes target     prot opt in     out     source        destination
 3267 1483K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
    0     0            all  --  *      eth0    0.0.0.0/0     192.168.0.2

I download squid-2.5.STABLE5.tar.gz from my ftp server. 
The size of squid is 1.3M

When I downloaded the bytes counter came in to the first command :-- you
can see that above.

Now when i did upload same squid package from local machine to remote
ftp server it doesnt show any bytes counter in second command :--you can
see that above ...counters bytes are 0.

so how can i count the upload bytes?
Where i have gone wrong ?
Any ideas?

Regards,
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com



On Wed, 2004-06-23 at 17:11, Antony Stone wrote:
> On Wednesday 23 June 2004 11:57 am, Joel wrote:
> 
> > On Wed, 2004-06-23 at 14:31, Antony Stone wrote:
> > >
> > > Beware of trying to do this if you are using the stateful connection
> > > tracking of netfilter (iptables -I FORWARD -m state --state
> > > ESTABLISHED,RELATED), because if you are, then almost all of the packets
> > > going through the machine (specifically, all except the first one of each
> > > connection) will be processed by this one rule, and all the other rules
> > > in the FORWARD chain will only see one packet per connection (the first
> > > one).
> > >
> > > You may be able to do what you want using the mangle table of the FORWARD
> > > chain, but not with the default filter table.
> >
> > Yes I am using stateful connection tracking of netfilter ( iptables -I
> > FORWARD -m state --state ESTABLISHED,RELATED)
> > So as per you i have used FORWARD chain in MANGLE table like this.
> >
> > # iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Download traffic  ---> M I right ?
> > # iptables -t mangle -i eth0 -A FORWARD -d 10.1.1.24/29 -j ACCEPT  ---> I
> > think for Upload traffic ----> M I right ?
> >
> > This is the output of 
> > # iptables -t mangle -nvL FORWARD
> >
> > Chain FORWARD (policy ACCEPT 1747K packets, 318M bytes)
> >  pkts bytes target     prot opt in     out     source             
> > destination
> > 1068 91499 ACCEPT     all  --  eth1   *       10.1.1.24/29         0.0.0.0/0
> >  148 26923 ACCEPT     all  --  eth0   *       0.0.0.0/0           
> > 10.1.1.24/29
> >
> > Antony i have lot of other ip address but i have created only this subnet
> > for mangle table for testing.
> > Traffic bytes are passing through this.
> > So is the correct method ?
> > Will be the bytes over here are accurate ???
> 
> The byte counts will be accurate, yes, and you have the correct idea about 
> using -s a.b.c.d and -d w.x.y.z to capture traffic to and from particular IP 
> addresses.
> 
> The thing I suggest you change, though, is not to have a -j ACCEPT at the end 
> of your rules - just let all the packets flow right through the mangle table, 
> with the rules simply counting them as they go past.
> 
> In other words, don't do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29 -j ACCEPT
> 
> Just do:
> 
> iptables -t mangle -i eth1 -A FORWARD -s 10.1.1.24/29
> 
> The packets will still get counted just the same.
> 
> The reason for this advice is that the filter table is for filtering; the nat 
> and mangle tables are not.   Therefore you shouldn't use targets like ACCEPT, 
> DROP, etc (which are filtering operations) anywhere except the filter tables.
> 
> Regards,
> 
> Antony.

Re: Ip accounting Help--> Urgent

[Antony Stone]

On Saturday 26 June 2004 5:30 am, Joel Solanki wrote:

> Hello all, ANTONY ...hoping something from u :)

Good morning :)

> I am testing ip accounting on my production server for last 2 days but i
> can sort the things. Any body if u could throw little light that would
> be really helpful to me.
> This is my testing results.
>
> # $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
> # $IPT -t mangle -o eth0 -A FORWARD -d 192.168.0.2
>
> Results:-
>
> Chain FORWARD (policy ACCEPT 6853 packets, 2981K bytes)
>  pkts bytes target     prot opt in     out     source        destination
>  3267 1483K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
>     0     0            all  --  *      eth0    0.0.0.0/0     192.168.0.2
>
> I download squid-2.5.STABLE5.tar.gz from my ftp server.
> The size of squid is 1.3M
>
> Now when i did upload same squid package from local machine to remote
> ftp server it doesnt show any bytes counter in second command :--you can
> see that above ...counters bytes are 0.

Two very obvious questions first - I don't think these will be the problem, 
but I might as well check:

1. Is the machine you are uploading to connected via eth0?
2. Does the machine you are uploading to have IP address 192.168.0.2?

Both the above must be "yes" for the second rule you have (the one that's not 
apparently working properly) to count packets.

Now for the suggestion where I think you *may* have an error:

3. Do you have any PREROUTING nat rules which mean that by the time packets 
hit the FORWARD chain, they're no longer addressed to 192.168.0.2?

A good way to answer this would be to show us the rule in your FORWARDing 
filter table which allows the connection (the upload connection which you are 
having problems measuring) to work.

I cannot think of any reason why a rule in the FORWARD mangle table would not 
see packets which are correctly being processed by the FORWARD filter table.

Regards,

Antony.

-- 
"There has always been an underlying argument that we should open up our 
source code more broadly. The fact is that we are learning from open source 
and we are opening our code more broadly through Shared Source.

Is there value to providing source code? The answer is unequivocally yes."

 - Jason Matusow, head of Microsoft's Shared Source Program, in response to 
recent leaks of Windows source code on the Internet.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Ip accounting Help--> Urgent

[Askar Ali Khan]

Antony www.freshmeat.net got lot of tool for ip accounting :)


On Sat, 26 Jun 2004 09:22:14 +0100, Antony Stone
<antony@soft-solutions.co.uk> wrote:
> On Saturday 26 June 2004 5:30 am, Joel Solanki wrote:
> 
> > Hello all, ANTONY ...hoping something from u :)
> 
> Good morning :)
> 
> > I am testing ip accounting on my production server for last 2 days but i
> > can sort the things. Any body if u could throw little light that would
> > be really helpful to me.
> > This is my testing results.
> >
> > # $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
> > # $IPT -t mangle -o eth0 -A FORWARD -d 192.168.0.2
> >
> > Results:-
> >
> > Chain FORWARD (policy ACCEPT 6853 packets, 2981K bytes)
> >  pkts bytes target     prot opt in     out     source        destination
> >  3267 1483K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
> >     0     0            all  --  *      eth0    0.0.0.0/0     192.168.0.2
> >
> > I download squid-2.5.STABLE5.tar.gz from my ftp server.
> > The size of squid is 1.3M
> >
> > Now when i did upload same squid package from local machine to remote
> > ftp server it doesnt show any bytes counter in second command :--you can
> > see that above ...counters bytes are 0.
> 
> Two very obvious questions first - I don't think these will be the problem,
> but I might as well check:
> 
> 1. Is the machine you are uploading to connected via eth0?
> 2. Does the machine you are uploading to have IP address 192.168.0.2?
> 
> Both the above must be "yes" for the second rule you have (the one that's not
> apparently working properly) to count packets.
> 
> Now for the suggestion where I think you *may* have an error:
> 
> 3. Do you have any PREROUTING nat rules which mean that by the time packets
> hit the FORWARD chain, they're no longer addressed to 192.168.0.2?
> 
> A good way to answer this would be to show us the rule in your FORWARDing
> filter table which allows the connection (the upload connection which you are
> having problems measuring) to work.
> 
> I cannot think of any reason why a rule in the FORWARD mangle table would not
> see packets which are correctly being processed by the FORWARD filter table.
> 
> Regards,
> 
> Antony.
> 
> --
> "There has always been an underlying argument that we should open up our
> source code more broadly. The fact is that we are learning from open source
> and we are opening our code more broadly through Shared Source.
> 
> Is there value to providing source code? The answer is unequivocally yes."
> 
> - Jason Matusow, head of Microsoft's Shared Source Program, in response to
> recent leaks of Windows source code on the Internet.
> 
>                                                     Please reply to the list;
>                                                           please don't CC me.
> 
>

Re: Ip accounting Help--> Urgent

[Joel Solanki]

Good morning Antone and all.

			
	LINUX SERVER eth0 200.200.200.200 (public ip) --> switch 
		     eth1 192.168.0.1/24   -------------> switch


Yes 192.168.0.2 is the ip of windows 98 machine.
I have done SNAT on linux server.
Below are the rules:-

[root@joel root]# iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 5321 packets, 1574K bytes)
 pkts bytes target     prot opt in     out     source        destination

Chain INPUT (policy ACCEPT 4 packets, 452 bytes)
 pkts bytes target     prot opt in     out     source        destination

Chain FORWARD (policy ACCEPT 5299 packets, 1571K bytes)
 pkts bytes target     prot opt in     out     source        destination
 2672 1461K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
 2627  110K            all  --  eth0   *       0.0.0.0/0     192.168.0.2

Chain OUTPUT (policy ACCEPT 2 packets, 140 bytes)
 pkts bytes target     prot opt in     out     source        destination

Chain POSTROUTING (policy ACCEPT 5301 packets, 1571K bytes)
 pkts bytes target     prot opt in     out     source        destination

[root@joel root]#

I have tested again this rules
I just upload squid.tar.gz which is of 1.3M. and i found the above
results. Its only showing the 110K bytes ...file is of 1.3M and traffic
bytes are more in other rule ..its showing 1461K. so i cant get what is
exactly going on with this chains...

Below are other iptables results..........
------------------------------------------------------------------------------------------------------------------------

[root@joel root]# iptables -nvL
Chain INPUT (policy ACCEPT 9 packets, 1053 bytes)
 pkts bytes target     prot opt in     out     source        destination
    0     0 ACCEPT     all  --  eth1   *       192.168.0.2   0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts	bytes	target	prot	opt	in	out	source		destination
2690	1462K	ACCEPT	all	--	*	eth1	192.168.0.2	0.0.0.0/0	state	NEW,RELATED,ESTABLISHED
2638	111K	ACCEPT	all	--	*	eth1	0.0.0.0/0	192.168.0.2	state	NEW,RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 7 packets, 450 bytes)
pkts	bytes	target	prot	opt	in	out	source		destination
---------------------------------------------------------------------------------------------------------------------------


[root@joel root]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 463 packets, 43776 bytes)
 pkts bytes target     prot opt in     out     source       destination

Chain POSTROUTING (policy ACCEPT 41 packets, 2532 bytes)
pkts	bytes	target	prot	opt	in	out	source		destination
237	12398	SNAT	all	--	*	eth0	192.168.0.2	0.0.0.0/0	to:200.200.200.200

Chain OUTPUT (policy ACCEPT 41 packets, 2532 bytes)
 pkts bytes target     prot opt in     out     source       destination


---------------------------------------------------------------------------------------------------------------------------

Regards,

On Sat, 2004-06-26 at 13:52, Antony Stone wrote:
> On Saturday 26 June 2004 5:30 am, Joel Solanki wrote:
> 
> > Hello all, ANTONY ...hoping something from u :)
> 
> Good morning :)
> 
> > I am testing ip accounting on my production server for last 2 days but i
> > can sort the things. Any body if u could throw little light that would
> > be really helpful to me.
> > This is my testing results.
> >
> > # $IPT -t mangle -i eth1 -A FORWARD -s 192.168.0.2
> > # $IPT -t mangle -o eth0 -A FORWARD -d 192.168.0.2
> >
> > Results:-
> >
> > Chain FORWARD (policy ACCEPT 6853 packets, 2981K bytes)
> >  pkts bytes target     prot opt in     out     source        destination
> >  3267 1483K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
> >     0     0            all  --  *      eth0    0.0.0.0/0     192.168.0.2
> >
> > I download squid-2.5.STABLE5.tar.gz from my ftp server.
> > The size of squid is 1.3M
> >
> > Now when i did upload same squid package from local machine to remote
> > ftp server it doesnt show any bytes counter in second command :--you can
> > see that above ...counters bytes are 0.
> 
> Two very obvious questions first - I don't think these will be the problem, 
> but I might as well check:
> 
> 1. Is the machine you are uploading to connected via eth0?
> 2. Does the machine you are uploading to have IP address 192.168.0.2?
> 
> Both the above must be "yes" for the second rule you have (the one that's not 
> apparently working properly) to count packets.
> 
> Now for the suggestion where I think you *may* have an error:
> 
> 3. Do you have any PREROUTING nat rules which mean that by the time packets 
> hit the FORWARD chain, they're no longer addressed to 192.168.0.2?
> 
> A good way to answer this would be to show us the rule in your FORWARDing 
> filter table which allows the connection (the upload connection which you are 
> having problems measuring) to work.
> 
> I cannot think of any reason why a rule in the FORWARD mangle table would not 
> see packets which are correctly being processed by the FORWARD filter table.
> 
> Regards,
> 
> Antony.
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com

Re: Ip accounting Help--> Urgent

[Antony Stone]

On Saturday 26 June 2004 10:20 am, Joel Solanki wrote:

> Good morning Antone and all.
>
> 	LINUX SERVER eth0 200.200.200.200 (public ip) --> switch
> 		     eth1 192.168.0.1/24   -------------> switch
>
> Yes 192.168.0.2 is the ip of windows 98 machine.

Windows 98?   And it's running an FTP server???

I'm surprised...

> Chain FORWARD (policy ACCEPT 5299 packets, 1571K bytes)
>  pkts bytes target     prot opt in     out     source        destination
>  2672 1461K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
>  2627  110K            all  --  eth0   *       0.0.0.0/0     192.168.0.2
>
> I have tested again this rules
> I just upload squid.tar.gz which is of 1.3M. and i found the above
> results. Its only showing the 110K bytes ...file is of 1.3M and traffic
> bytes are more in other rule ..its showing 1461K. so i cant get what is
> exactly going on with this chains...

Please let's clarify which machine is doing exactly what...

You say you have a Windows 98 machine on IP 192.168.0.2

Your rules have recorded 1461kbytes *sent from* that machine to somewhere 
else, and 110kbytes *received by* that machine from somewhere.

That to me is entirely consistent with you saying you have uploaded (by which 
I assume you mean "sent to somewhere else") 1.3Mbytes of data by FTP.

My suggestion is:
1. Clear the counters to zero with "iptables -Z FORWARD -t mangle"
2. Download (receive) a file on machine 192.168.0.2 of some known size.
3. Check the counters with "iptables -L FORWARD -t mangle -nvx"
4. Upload (send) some *other* file of a different size from machine 
192.168.0.2
5. Check the counters again.
6. Let us know if the first rule shows a byte count noticeably different from 
what you sent, or the second rule shows a byte count noticeably different 
from what you received.

Hope this helps,

Antony.

-- 
Behind the counter a boy with a shaven head stared vacantly into space,
a dozen spikes of microsoft protruding from the socket behind his ear.

 - William Gibson, Neuromancer (1984)

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Ip accounting Help--> Urgent

[Joel Solanki]

I am working on what you have suggested...in 7 mins.I will be back with
an email.
Some clarification.

192.168.0.2 is windows 98 machine
From win98 machine i upload a file on my other ftp server which has a
public ip address.
I am only using win98 machine as client. i am downloading squid.tar.gz
from my ftp server and that file i m again uploading to my ftp server.
So this is the right things ........
On my linux server i m doing nothing except the iptables rule. 

I will be back in 7 mins.:)
Regards,


On Sat, 2004-06-26 at 14:59, Antony Stone wrote:
> On Saturday 26 June 2004 10:20 am, Joel Solanki wrote:
> 
> > Good morning Antone and all.
> >
> > 	LINUX SERVER eth0 200.200.200.200 (public ip) --> switch
> > 		     eth1 192.168.0.1/24   -------------> switch
> >
> > Yes 192.168.0.2 is the ip of windows 98 machine.
> 
> Windows 98?   And it's running an FTP server???
> 
> I'm surprised...
> 
> > Chain FORWARD (policy ACCEPT 5299 packets, 1571K bytes)
> >  pkts bytes target     prot opt in     out     source        destination
> >  2672 1461K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
> >  2627  110K            all  --  eth0   *       0.0.0.0/0     192.168.0.2
> >
> > I have tested again this rules
> > I just upload squid.tar.gz which is of 1.3M. and i found the above
> > results. Its only showing the 110K bytes ...file is of 1.3M and traffic
> > bytes are more in other rule ..its showing 1461K. so i cant get what is
> > exactly going on with this chains...
> 
> Please let's clarify which machine is doing exactly what...
> 
> You say you have a Windows 98 machine on IP 192.168.0.2
> 
> Your rules have recorded 1461kbytes *sent from* that machine to somewhere 
> else, and 110kbytes *received by* that machine from somewhere.
> 
> That to me is entirely consistent with you saying you have uploaded (by which 
> I assume you mean "sent to somewhere else") 1.3Mbytes of data by FTP.
> 
> My suggestion is:
> 1. Clear the counters to zero with "iptables -Z FORWARD -t mangle"
> 2. Download (receive) a file on machine 192.168.0.2 of some known size.
> 3. Check the counters with "iptables -L FORWARD -t mangle -nvx"
> 4. Upload (send) some *other* file of a different size from machine 
> 192.168.0.2
> 5. Check the counters again.
> 6. Let us know if the first rule shows a byte count noticeably different from 
> what you sent, or the second rule shows a byte count noticeably different 
> from what you received.
> 
> Hope this helps,
> 
> Antony.
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com

Re: Ip accounting Help--> Urgent

[Joel Solanki]

Helloo..Antone and all. 


[root@joel root]# iptables -L FORWARD -t mangle -nvx

Chain FORWARD (policy ACCEPT 6375 packets, 1886840 bytes)
pkts	bytes	target	prot	opt	in	out	source		destination
3200	1742989		all	--	eth1	*	192.168.0.2	0.0.0.0/0
3175	143851		all	--	eth0	*	0.0.0.0/0	192.168.0.2


This is the result when i uploaded to remote ftp server which is in our
network . File Uploaded php.pdf size=1:53 MB

------------------------------------

[root@joel root]# iptables -L FORWARD -t mangle -nvx

Chain FORWARD (policy ACCEPT 8923 packets, 3794033 bytes)
pkts	bytes	target	prot	opt	in	out	source		destination
4308	1803901		all	--	eth1	*	192.168.0.2	0.0.0.0/0
4615	1990132		all	--	eth0	*	0.0.0.0/0	192.168.0.2

This is the result when i download squid.tar.gz from ftp server which is
in my network. file size is 1.25MB
-------------------------------------

This is according to your suggestion but i have used the ftp server
which is in my network. I havent used ftp server of my linux server on
which iptables and nat is done.

So here also when uploading the file bytes are filled in the first
iptables chain with source 192.168.0.2 and destination 0.0.0.0/0 on eth1
Some Ideas.........:)
Regards,





On Sat, 2004-06-26 at 14:59, Antony Stone wrote:
> On Saturday 26 June 2004 10:20 am, Joel Solanki wrote:
> 
> > Good morning Antone and all.
> >
> > 	LINUX SERVER eth0 200.200.200.200 (public ip) --> switch
> > 		     eth1 192.168.0.1/24   -------------> switch
> >
> > Yes 192.168.0.2 is the ip of windows 98 machine.
> 
> Windows 98?   And it's running an FTP server???
> 
> I'm surprised...
> 
> > Chain FORWARD (policy ACCEPT 5299 packets, 1571K bytes)
> >  pkts bytes target     prot opt in     out     source        destination
> >  2672 1461K            all  --  eth1   *       192.168.0.2   0.0.0.0/0
> >  2627  110K            all  --  eth0   *       0.0.0.0/0     192.168.0.2
> >
> > I have tested again this rules
> > I just upload squid.tar.gz which is of 1.3M. and i found the above
> > results. Its only showing the 110K bytes ...file is of 1.3M and traffic
> > bytes are more in other rule ..its showing 1461K. so i cant get what is
> > exactly going on with this chains...
> 
> Please let's clarify which machine is doing exactly what...
> 
> You say you have a Windows 98 machine on IP 192.168.0.2
> 
> Your rules have recorded 1461kbytes *sent from* that machine to somewhere 
> else, and 110kbytes *received by* that machine from somewhere.
> 
> That to me is entirely consistent with you saying you have uploaded (by which 
> I assume you mean "sent to somewhere else") 1.3Mbytes of data by FTP.
> 
> My suggestion is:
> 1. Clear the counters to zero with "iptables -Z FORWARD -t mangle"
> 2. Download (receive) a file on machine 192.168.0.2 of some known size.
> 3. Check the counters with "iptables -L FORWARD -t mangle -nvx"
> 4. Upload (send) some *other* file of a different size from machine 
> 192.168.0.2
> 5. Check the counters again.
> 6. Let us know if the first rule shows a byte count noticeably different from 
> what you sent, or the second rule shows a byte count noticeably different 
> from what you received.
> 
> Hope this helps,
> 
> Antony.
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com

Re: Ip accounting Help--> Urgent

[Antony Stone]

On Saturday 26 June 2004 11:23 am, Joel Solanki wrote:

> [root@joel root]# iptables -L FORWARD -t mangle -nvx
>
> Chain FORWARD (policy ACCEPT 6375 packets, 1886840 bytes)
> pkts	bytes	target	prot	opt	in	out	source		destination
> 3200	1742989		all	--	eth1	*	192.168.0.2	0.0.0.0/0
> 3175	143851		all	--	eth0	*	0.0.0.0/0	192.168.0.2
>
> This is the result when i uploaded to remote ftp server which is in our
> network . File Uploaded php.pdf size=1:53 MB

Looks completely correct to me.

File uploaded=1.53Mbytes
1742989 bytes shown coming from 192.168.0.2

> [root@joel root]# iptables -L FORWARD -t mangle -nvx
>
> Chain FORWARD (policy ACCEPT 8923 packets, 3794033 bytes)
> pkts	bytes	target	prot	opt	in	out	source		destination
> 4308	1803901		all	--	eth1	*	192.168.0.2	0.0.0.0/0
> 4615	1990132		all	--	eth0	*	0.0.0.0/0	192.168.0.2
>
> This is the result when i download squid.tar.gz from ftp server which is
> in my network. file size is 1.25MB

File downloaded = 1.25Mbytes
1990132-(some allowance for the traffic already counted) bytes shown going to 
192.168.0.2

I see no discrepancies here.

> This is according to your suggestion but i have used the ftp server
> which is in my network. I havent used ftp server of my linux server on
> which iptables and nat is done.

Hang on a minute!

Are you saying that the FTP server you are trying to count the traffic from/to 
is *on* the netfilter machine!?

Well, first of all, you shouldn't be running applications on your firewall, 
and secondly, all the rules we've been talking about are in your FORWARD 
chain - they will count packets routed *through* the machine, not packets 
sent to or from the machine itself.

If you want to count traffic to & from the machine itself then you need to put 
the rules in INPUT and OUTPUT.

Regards,

Antony.

-- 
These clients are often infected by viruses or other malware and need to be 
fixed.  If not, the user at that client needs to be fixed...

 - Henrik Nordstrom, on Squid users' mailing list

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Ip accounting Help--> Urgent

[Joel Solanki]

Hi antone ...

Ftp server is different.
Its in other location.
So now upload and download are accurate.
I am doing further testing ...
Seems its working good. 

Thank you very much for yur help and others too.
If i got any queries i will be back again..:)

Regards,



On Sat, 2004-06-26 at 16:46, Antony Stone wrote:
> On Saturday 26 June 2004 11:23 am, Joel Solanki wrote:
> 
> > [root@joel root]# iptables -L FORWARD -t mangle -nvx
> >
> > Chain FORWARD (policy ACCEPT 6375 packets, 1886840 bytes)
> > pkts	bytes	target	prot	opt	in	out	source		destination
> > 3200	1742989		all	--	eth1	*	192.168.0.2	0.0.0.0/0
> > 3175	143851		all	--	eth0	*	0.0.0.0/0	192.168.0.2
> >
> > This is the result when i uploaded to remote ftp server which is in our
> > network . File Uploaded php.pdf size=1:53 MB
> 
> Looks completely correct to me.
> 
> File uploaded=1.53Mbytes
> 1742989 bytes shown coming from 192.168.0.2
> 
> > [root@joel root]# iptables -L FORWARD -t mangle -nvx
> >
> > Chain FORWARD (policy ACCEPT 8923 packets, 3794033 bytes)
> > pkts	bytes	target	prot	opt	in	out	source		destination
> > 4308	1803901		all	--	eth1	*	192.168.0.2	0.0.0.0/0
> > 4615	1990132		all	--	eth0	*	0.0.0.0/0	192.168.0.2
> >
> > This is the result when i download squid.tar.gz from ftp server which is
> > in my network. file size is 1.25MB
> 
> File downloaded = 1.25Mbytes
> 1990132-(some allowance for the traffic already counted) bytes shown going to 
> 192.168.0.2
> 
> I see no discrepancies here.
> 
> > This is according to your suggestion but i have used the ftp server
> > which is in my network. I havent used ftp server of my linux server on
> > which iptables and nat is done.
> 
> Hang on a minute!
> 
> Are you saying that the FTP server you are trying to count the traffic from/to 
> is *on* the netfilter machine!?
> 
> Well, first of all, you shouldn't be running applications on your firewall, 
> and secondly, all the rules we've been talking about are in your FORWARD 
> chain - they will count packets routed *through* the machine, not packets 
> sent to or from the machine itself.
> 
> If you want to count traffic to & from the machine itself then you need to put 
> the rules in INPUT and OUTPUT.
> 
> Regards,
> 
> Antony.
-- 
Joel n.solanki
Systems Administrator
(M) 91-9825500258
D2V ISP PVT LTD
http://www.d2visp.com