bytes count question

bytes count question

[Michele Petrazzo - Unipex srl]

Hi list,
I'm making some test for see "how many traffic" create an IP, so, into
the gateway, I create a chain, add a rule so all the traffic go through
it, and here accept all the traffic.
After, from that IP, I download a file that has 1 MB and I control with
a "iptables -nxvL my_chain" what number are on the "bytes" columns, but
with a big surprise, I see 60000.
What're this number?

I thought to find something like 1048000 (or similar)!

I'm missing something?

Thanks,
Michele

RE: bytes count question

[Sietse van Zanen]

Yes, only the first packet of a connection is counted. You should use a
traffic analyzer for what you want to do.

-Sietse



-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Michele
Petrazzo - Unipex srl
Sent: Thursday, March 15, 2007 15:57
To: netfilter@lists.netfilter.org
Subject: bytes count question

Hi list,
I'm making some test for see "how many traffic" create an IP, so, into
the gateway, I create a chain, add a rule so all the traffic go through
it, and here accept all the traffic.
After, from that IP, I download a file that has 1 MB and I control with
a "iptables -nxvL my_chain" what number are on the "bytes" columns, but
with a big surprise, I see 60000.
What're this number?

I thought to find something like 1048000 (or similar)!

I'm missing something?

Thanks,
Michele

RE: bytes count question

[Sietse van Zanen]

Uh, no I think I may be wrong here. That might only count for NAT
packets.

The 600.000 bytes might be due to compression. How did you download the
file?

-Sietse

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Sietse van
Zanen
Sent: Thursday, March 15, 2007 18:00
To: Michele Petrazzo - Unipex srl; netfilter@lists.netfilter.org
Subject: RE: bytes count question

Yes, only the first packet of a connection is counted. You should use a
traffic analyzer for what you want to do.

-Sietse



-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Michele
Petrazzo - Unipex srl
Sent: Thursday, March 15, 2007 15:57
To: netfilter@lists.netfilter.org
Subject: bytes count question

Hi list,
I'm making some test for see "how many traffic" create an IP, so, into
the gateway, I create a chain, add a rule so all the traffic go through
it, and here accept all the traffic.
After, from that IP, I download a file that has 1 MB and I control with
a "iptables -nxvL my_chain" what number are on the "bytes" columns, but
with a big surprise, I see 60000.
What're this number?

I thought to find something like 1048000 (or similar)!

I'm missing something?

Thanks,
Michele

Re: bytes count question

[Michele Petrazzo - Unipex srl]

Sietse van Zanen wrote:
> Uh, no I think I may be wrong here. That might only count for NAT 
> packets.
> 
> The 600.000 bytes might be due to compression. How did you download
> the file?
> 

Just discovered that that was the right values, but of the upload! :)
I was wrong because now, with the right "download" rule (so a rule that
see the traffic "to" and not from the test machine)!

> -Sietse

Thanks,
Michele

Re: bytes count question

[Jan Engelhardt]

On Mar 15 2007 15:56, Michele Petrazzo - Unipex srl wrote:
>
> Hi list,
> I'm making some test for see "how many traffic" create an IP, so, into
> the gateway, I create a chain, add a rule so all the traffic go through
> it, and here accept all the traffic.
> After, from that IP, I download a file that has 1 MB and I control with
> a "iptables -nxvL my_chain" what number are on the "bytes" columns, but
> with a big surprise, I see 60000.
> What're this number?
>
> I thought to find something like 1048000 (or similar)!


(1) What is counted is L3 bytes, i.e. includes IP and TCP headers.
(2) Compression on L4 (ipcomp) or L7 (gzipped HTTP transfer)
(3) Use of caching proxies may reduce bandwidth by returned fresh entries

And BTW, any traffic analyzer (like iptraf) will show the same counting.


Jan
--