* Empty Target
@ 2009-02-06 22:05 Gilad Benjamini
2009-02-07 2:15 ` Robert Nichols
2009-02-07 7:12 ` Vincent Bernat
0 siblings, 2 replies; 3+ messages in thread
From: Gilad Benjamini @ 2009-02-06 22:05 UTC (permalink / raw)
To: netfilter
I am trying to troubleshoot an iptables rule set, trying to understand where
different packets are going. I have found that using "iptables -L -v" is a
useful tool, with the counters telling me what's going on.
To "trigger" counters I currently use LOG rules. I would actually prefer
some sort of empty rule; a rule that would do nothing beyond increasing the
counters.
Does something like that exist ?
Seems trivial to implement.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Empty Target
2009-02-06 22:05 Empty Target Gilad Benjamini
@ 2009-02-07 2:15 ` Robert Nichols
2009-02-07 7:12 ` Vincent Bernat
1 sibling, 0 replies; 3+ messages in thread
From: Robert Nichols @ 2009-02-07 2:15 UTC (permalink / raw)
To: netfilter
Gilad Benjamini wrote:
> I am trying to troubleshoot an iptables rule set, trying to understand where
> different packets are going. I have found that using "iptables -L -v" is a
> useful tool, with the counters telling me what's going on.
> To "trigger" counters I currently use LOG rules. I would actually prefer
> some sort of empty rule; a rule that would do nothing beyond increasing the
> counters.
>
> Does something like that exist ?
> Seems trivial to implement.
Extremely trivial, and already there. There is no requirement that a rule
must have a target. Just write the rule without one. I have several such
rules in my ruleset.
--
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Empty Target
2009-02-06 22:05 Empty Target Gilad Benjamini
2009-02-07 2:15 ` Robert Nichols
@ 2009-02-07 7:12 ` Vincent Bernat
1 sibling, 0 replies; 3+ messages in thread
From: Vincent Bernat @ 2009-02-07 7:12 UTC (permalink / raw)
To: Gilad Benjamini; +Cc: netfilter
OoO La nuit ayant déjà recouvert d'encre ce jour du vendredi 06 février
2009, vers 23:05, "Gilad Benjamini" <gilad.benjamini@gmail.com> disait :
> I am trying to troubleshoot an iptables rule set, trying to understand where
> different packets are going. I have found that using "iptables -L -v" is a
> useful tool, with the counters telling me what's going on.
> To "trigger" counters I currently use LOG rules. I would actually prefer
> some sort of empty rule; a rule that would do nothing beyond increasing the
> counters.
> Does something like that exist ?
> Seems trivial to implement.
You can also use the TRACE target if your kernel is recent enough.
--
I WILL NOT GREASE THE MONKEY BARS
I WILL NOT GREASE THE MONKEY BARS
I WILL NOT GREASE THE MONKEY BARS
-+- Bart Simpson on chalkboard in episode 7F17
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-02-07 7:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-02-06 22:05 Empty Target Gilad Benjamini
2009-02-07 2:15 ` Robert Nichols
2009-02-07 7:12 ` Vincent Bernat
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.