iptables traffic accounting...

iptables traffic accounting...

[Vladimir S. Petukhov]

sorry for my english...
How can I calculate total traffic from/to single process?
It's easy to calculate outgoing traffic using --owner rule, but what's about 
ingoing?
process may be identify by PID & uid/euid/gid...

-- 
Fanaticism consists of redoubling your effort when you have forgotten your 
aim.
		-- George Santayana

Now playing: 01 Sleeper - Severe Clear.mp3
   AutoGenerated by fortune & xmms...

Re: iptables traffic accounting...

[Jason Opperisano]

On Sat, 2004-12-04 at 08:53, Vladimir S. Petukhov wrote:
> sorry for my english...
> How can I calculate total traffic from/to single process?
> It's easy to calculate outgoing traffic using --owner rule, but what's about 
> ingoing?
> process may be identify by PID & uid/euid/gid...

i *think* the "owner-socketlookup" patch from POM allows you to use "-m
owner" in INPUT.

-j

--
"Ah, good ol' trustworthy beer. My love for you will never die."
	--The Simpsons

Re: iptables traffic accounting...

[Jose Maria Lopez]

El sáb, 04 de 12 de 2004 a las 14:53, Vladimir S. Petukhov escribió:
> sorry for my english...
> How can I calculate total traffic from/to single process?
> It's easy to calculate outgoing traffic using --owner rule, but what's about 
> ingoing?
> process may be identify by PID & uid/euid/gid...

I use a -m owner rule to jump to a chain that only has a RETURN rule
and then read the counters for this chain to obtain the traffic
for that user/process.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"