Probing counters without calling IPtables -L

Probing counters without calling IPtables -L

[mase hare]

Good day all NetFilter/IPtables developers!

I am a IPtables user, and I do like it very much.
Thats why I want to use IPtables with my development.
I want to develop my own C program to compilment
IPtables to do accounting on network traffic for me.

Now there is plenty of accounting programs available
on the web, but most uses scripts with the iptables -L -v
command to generate sumarry files.

I would like to build a stand-alone deamon to probe
only the specific rules' counters ( packets, bytes ),
thus no scripting, and no iptables -L -v.

I think this was possible with IPchaincs by looking in
a specific file in /proc/net/ip_*

---------------------------------
Now my question is:
Is there for IPtables also a file which one can cat
to read the counters from, in /proc/net/*?
And if not, what -in your opinions- would be the
best course for me to take
in getting these counters inside my C program
with their source and destination addresses.
---------------------------------

Thank You very much for the time and effort!
I do appriciate it truly.

Yours,

Mase Hare




__________________________________________________________________________
http://www.webmail.co.za/dialup Webmail ISP - Cool Connection, Cool Price

Re: Probing counters without calling IPtables -L

[Pablo Neira]

Hi mase,

mase hare wrote:

>Good day all NetFilter/IPtables developers!
>
>I am a IPtables user, and I do like it very much.
>Thats why I want to use IPtables with my development.
>I want to develop my own C program to compilment
>IPtables to do accounting on network traffic for me.
>
>Now there is plenty of accounting programs available
>on the web, but most uses scripts with the iptables -L -v
>command to generate sumarry files.
>
>I would like to build a stand-alone deamon to probe
>only the specific rules' counters ( packets, bytes ),
>thus no scripting, and no iptables -L -v.
>
>I think this was possible with IPchaincs by looking in
>a specific file in /proc/net/ip_*
>
>---------------------------------
>Now my question is:
>Is there for IPtables also a file which one can cat
>to read the counters from, in /proc/net/*?
>And if not, what -in your opinions- would be the
>best course for me to take
>in getting these counters inside my C program
>with their source and destination addresses.
>---------------------------------
>  
>
Anyway, if you are thinking about reading from /proc/net/* in short 
period of time, you must take into account that this will decrease 
considerably the performance. Harald pointed out a similar issue for 
iptstate.

regards,
Pablo