Re: [netfilter-core] strange iptables statistics =(

Re: [netfilter-core] strange iptables statistics =(

[Patrick McHardy]

Tbis belongs on netfilter-devel ..

Renat Araslanow wrote:
> hi!
> 
> subj in iptables 1.26 on redhat 7.3 ipv4
> 
> as u can see in "ufanets_out" chain there is 328 packets, but in chain
> "by_protocol_out" we see only 1 udp packet. i have one more ip range - and
> its reported ok. can u explain me this please? thanks in advance.
> 
> PS% i dont see that similair bug is fixed in more modern versions of
> iptables - so don't yet upgraded.
> 
> Chain OUTPUT (policy ACCEPT 3887 packets, 2621833 bytes)
>     pkts      bytes target     prot opt in     out     source
> destination
>     9176  4237257            all  --  *      *       0.0.0.0/0
> 0.0.0.0/0
>      156    18884 ACCEPT     all  --  *      *       0.0.0.0/0
> 213.24.120.72
>     5133  1596540 ACCEPT     all  --  *      *       0.0.0.0/0
> 127.0.0.1
>     3887  2621833 accounting_out  all  --  *      *       0.0.0.0/0
> 0.0.0.0/0
> 
> Chain accounting_out (1 references)
>     pkts      bytes target     prot opt in     out     source
> destination
>     3887  2621833 ufanet_nets_out  all  --  *      *       0.0.0.0/0
> 0.0.0.0/0
>     3887  2621833 by_protocol_out  all  --  *      *       0.0.0.0/0
> 0.0.0.0/0
> 
> Chain ufanet_nets_out (1 references)
>     pkts      bytes target     prot opt in     out     source
> destination
>      328    15649 RETURN     all  --  *      *       0.0.0.0/0
> 213.24.120.70
> 
> Chain by_protocol_out (1 references)
>     pkts      bytes target     prot opt in     out     source
> destination
>      134    10790            udp  --  *      *       0.0.0.0/0
> 0.0.0.0/0
>        4      660            icmp --  *      *       0.0.0.0/0
> 0.0.0.0/0
>     3049  2573511            tcp  --  *      *       0.0.0.0/0
> 0.0.0.0/0          multiport sports 80,8080,443
>        0        0            tcp  --  *      *       0.0.0.0/0
> 0.0.0.0/0          tcp spts:20:21
>       75     5883            tcp  --  *      *       0.0.0.0/0
> 0.0.0.0/0          multiport dports 110,25
> 
>        1      121            udp  --  *      *       0.0.0.0/0
> 213.24.120.70
>        0        0            icmp --  *      *       0.0.0.0/0
> 213.24.120.70
>        0        0 RETURN     tcp  --  *      *       0.0.0.0/0
> 213.24.120.70      multiport sports 80,8080,443
>        0        0 RETURN     tcp  --  *      *       0.0.0.0/0
> 213.24.120.70      tcp spts:20:21
>        0        0 RETURN     tcp  --  *      *       0.0.0.0/0
> 213.24.120.70      multiport dports 110,25
> 
> 

Re: [netfilter-core] strange iptables statistics =(

[Henrik Nordstrom]

Renat Araslanow wrote:

> as u can see in "ufanets_out" chain there is 328 packets, but in chain
> "by_protocol_out" we see only 1 udp packet. i have one more ip range - and
> its reported ok. can u explain me this please? thanks in advance.

the ufanets_out chain counts all kinds of packets, not only UDP..

by_protocol_out does not count all kinds of packets, only a small set of 
selected packets.

there is a large number of situations where these two will not add up as 
there is very many kinds of packets which will not be counted by your 
by_protocol_out chain.

Regards
Henrik