quota display in iptables -L

quota display in iptables -L

[James Anderson]

Hello everyone.

I have been trying to get iptables to stop traffic to the internet
after I have exceeded 29.8 GB and just allow traffic to the local
subnet after that. I did the conversion on google and apparently
29.8GB is 31997506400 bytes. However tonight when I got home and did
iptables -L -v, I saw this:

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination
   28M    32G   ACCEPT     all  --  any    any     anywhere
!192.168.2.0/24      quota: 31997506400 bytes
2459K 3621M  ACCEPT     all  --  any    any     anywhere
192.168.2.0/24
  5770 1151K   REJECT     all  --  any    any     anywhere
anywhere            reject-with icmp-port-unreachable

At first I thought the quota didn't work, but then I did iptables-save -c

*filter
:INPUT ACCEPT [23078834:14787771556]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
[28216466:31997506128] -A OUTPUT ! -d 192.168.2.0/24 -m quota --quota
31997506400 -j ACCEPT
[2475569:3622559686] -A OUTPUT -d 192.168.2.0/24 -j ACCEPT
[24154:2350411] -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT

which shows that it stopped at 29.7999998 GB.
Could someone perhaps explain the discrepancy?
Does iptables keep counting bytes even after the quota is full?

many thanks in advance,

James

Re: quota display in iptables -L

[Gáspár Lajos]

Hi,

31997506400-31997506128=272
You are under the quota!

Maybe you had just bigger packets than 272 bytes...


Swifty



2012-03-09 01:19 keltezéssel, James Anderson írta:
> Hello everyone.
>
> I have been trying to get iptables to stop traffic to the internet
> after I have exceeded 29.8 GB and just allow traffic to the local
> subnet after that. I did the conversion on google and apparently
> 29.8GB is 31997506400 bytes. However tonight when I got home and did
> iptables -L -v, I saw this:
>
> Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
>   pkts bytes target     prot opt in     out     source
> destination
>     28M    32G   ACCEPT     all  --  any    any     anywhere
> !192.168.2.0/24      quota: 31997506400 bytes
> 2459K 3621M  ACCEPT     all  --  any    any     anywhere
> 192.168.2.0/24
>    5770 1151K   REJECT     all  --  any    any     anywhere
> anywhere            reject-with icmp-port-unreachable
>
> At first I thought the quota didn't work, but then I did iptables-save -c
>
> *filter
> :INPUT ACCEPT [23078834:14787771556]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> [28216466:31997506128] -A OUTPUT ! -d 192.168.2.0/24 -m quota --quota
> 31997506400 -j ACCEPT
> [2475569:3622559686] -A OUTPUT -d 192.168.2.0/24 -j ACCEPT
> [24154:2350411] -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
> COMMIT
>
> which shows that it stopped at 29.7999998 GB.
> Could someone perhaps explain the discrepancy?
> Does iptables keep counting bytes even after the quota is full?
>
> many thanks in advance,
>
> James
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: quota display in iptables -L

[James Anderson]

> 31997506400-31997506128=272
> You are under the quota!

Thank you for your reply. By discrepancy I mean iptables -L -v showing
32GB and iptables-save showing the correct point where it stopped, at
the quota. That's a 2.2GB difference.



>
> 2012-03-09 01:19 keltezéssel, James Anderson írta:
>>
>> Hello everyone.
>>
>> I have been trying to get iptables to stop traffic to the internet
>> after I have exceeded 29.8 GB and just allow traffic to the local
>> subnet after that. I did the conversion on google and apparently
>> 29.8GB is 31997506400 bytes. However tonight when I got home and did
>> iptables -L -v, I saw this:
>>
>> Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
>>  pkts bytes target     prot opt in     out     source
>> destination
>>    28M    32G   ACCEPT     all  --  any    any     anywhere
>> !192.168.2.0/24      quota: 31997506400 bytes
>> 2459K 3621M  ACCEPT     all  --  any    any     anywhere
>> 192.168.2.0/24
>>   5770 1151K   REJECT     all  --  any    any     anywhere
>> anywhere            reject-with icmp-port-unreachable
>>
>> At first I thought the quota didn't work, but then I did iptables-save -c
>>
>> *filter
>> :INPUT ACCEPT [23078834:14787771556]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [0:0]
>> [28216466:31997506128] -A OUTPUT ! -d 192.168.2.0/24 -m quota --quota
>> 31997506400 -j ACCEPT
>> [2475569:3622559686] -A OUTPUT -d 192.168.2.0/24 -j ACCEPT
>> [24154:2350411] -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
>> COMMIT
>>
>> which shows that it stopped at 29.7999998 GB.
>> Could someone perhaps explain the discrepancy?
>> Does iptables keep counting bytes even after the quota is full?
>>
>> many thanks in advance,
>>
>> James
>> --
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: quota display in iptables -L

[Gáspár Lajos]

Hi,

Well... Check out these links:

http://en.wikipedia.org/wiki/Byte
http://www.unitjuggler.com/convert-memory-from-GB-to-GiB.html

2012-03-09 17:35 keltezéssel, James Anderson írta:
>> 31997506400-31997506128=272
>> You are under the quota!
> Thank you for your reply. By discrepancy I mean iptables -L -v showing
> 32GB and iptables-save showing the correct point where it stopped, at
> the quota. That's a 2.2GB difference.

29.8GiByte (binary) = 31 997 506 355.2 Byte  = 31.997 506 355 GByte (SI) 
(nearly 32 000 000 000 Byte = 32 GByte)

There is no 2.2 GB difference... :D You are mixing prefixes... :D GiByte 
!= GByte

See below:

29.8GiByte (binary) = 29.8*1024*1024*1024 = 31 997 506 355.2 Byte
29.8GByte (SI) = 29.8*1000*1000*1000 = 29 800 000 000 Byte

32GiByte (binary) = 32*1024*1024*1024 = 34 359 738 368 Byte
32GByte (SI) = 32*1000*1000*1000 = 32 000 000 000 Byte

31 997 506 400 Byte = 31.997 506 400 GByte (SI)
31 997 506 400 Byte = 29.8000000417232513427734375 GiByte (binary)

32 000 000 000 Byte = 32GByte (SI)
32 000 000 000 Byte = 29.802322387695 GiByte (binary)

Swifty