* conntrack
@ 2012-02-14 12:48 Stephen Clark
2012-02-14 19:54 ` conntrack Pablo Neira Ayuso
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Clark @ 2012-02-14 12:48 UTC (permalink / raw)
To: Netfilter Developer Mailing List
Hi,
Does connection tracking keep any counters on number of packets/and or
bytes that are
associated with a connection? If so how does one access them?
Thanks,
Steve
--
"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety." (Ben Franklin)
"The course of history shows that as a government grows, liberty
decreases." (Thomas Jefferson)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack
2012-02-14 12:48 conntrack Stephen Clark
@ 2012-02-14 19:54 ` Pablo Neira Ayuso
2012-02-15 3:41 ` conntrack Stephen Clark
2012-02-15 14:00 ` conntrack Stephen Clark
0 siblings, 2 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2012-02-14 19:54 UTC (permalink / raw)
To: Stephen Clark; +Cc: Netfilter Developer Mailing List
On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
> Hi,
>
> Does connection tracking keep any counters on number of packets/and
> or bytes that are
> associated with a connection? If so how does one access them?
echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct
Then, you can access them via:
conntrack -L
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack
2012-02-14 19:54 ` conntrack Pablo Neira Ayuso
@ 2012-02-15 3:41 ` Stephen Clark
2012-02-15 14:00 ` conntrack Stephen Clark
1 sibling, 0 replies; 5+ messages in thread
From: Stephen Clark @ 2012-02-15 3:41 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Netfilter Developer Mailing List
On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>
> echo 1> /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>
Thanks
--
"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety." (Ben Franklin)
"The course of history shows that as a government grows, liberty
decreases." (Thomas Jefferson)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack
2012-02-14 19:54 ` conntrack Pablo Neira Ayuso
2012-02-15 3:41 ` conntrack Stephen Clark
@ 2012-02-15 14:00 ` Stephen Clark
2012-02-15 14:27 ` conntrack Chris Wilson
1 sibling, 1 reply; 5+ messages in thread
From: Stephen Clark @ 2012-02-15 14:00 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Netfilter Developer Mailing List
On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote:
> On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote:
>
>> Hi,
>>
>> Does connection tracking keep any counters on number of packets/and
>> or bytes that are
>> associated with a connection? If so how does one access them?
>>
> echo 1> /proc/sys/net/netfilter/nf_conntrack_acct
>
> Then, you can access them via:
>
> conntrack -L
>
>
Hi Pablo,
I have been working with FreeBSD for about 10 years and using ipfilter.
It has a neat tool ipfstat -t which show the state table
sort of like top. It is very useful if someone is hogging the network
because it is sorted by the highest user first. We are switching
our systems to Linux and would like to know fs there anything like this
for conntrack?
Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes
Source IP Destination IP ST PR #pkts
#bytes ttl
192.168.198.105,5353 224.0.0.251,5353 0/0 udp 22598
3736235 1:57
10.0.254.32,631 10.0.255.255,631 0/0 udp 11872
2623712 1:29
192.168.198.103,5353 224.0.0.251,5353 0/0 udp 10608
1720665 1:56
192.168.198.103,5353 224.0.0.251,5353 0/0 udp 10608
1720665 1:56
10.0.254.32,5353 224.0.0.251,5353 0/0 udp 9807
1680621 1:56
10.0.254.32,5353 224.0.0.251,5353 0/0 udp 9806
1680485 1:56
192.168.198.166,50676 192.168.198.75,8181 4/4 tcp 2412 1548504
81:09:04
192.168.198.148,137 192.168.198.255,137 0/0 udp 18625
1452750 1:51
10.0.254.32,631 10.0.255.255,631 0/0 udp 6082
1344122 1:29
192.168.198.148,137 192.168.198.255,137 0/0 udp 14186
1107048 1:51
10.0.129.11,5353 224.0.0.251,5353 0/0 udp 5841
1016739 1:56
10.0.129.11,5353 224.0.0.251,5353 0/0 udp 5840
1016566 1:56
192.168.198.148,137 192.168.198.255,137 0/0 udp 12427
969306 1:51
10.0.133.2,34114 216.17.35.103,143 4/4 tcp 13118 852888
119:59:36
192.168.198.105,5353 224.0.0.251,5353 0/0 udp 3790
828335 1:57
192.168.198.8,5353 224.0.0.251,5353 0/0 udp 5856
826713 1:57
192.168.198.8,5353 224.0.0.251,5353 0/0 udp 5856
826713 1:57
192.168.198.108,5353 224.0.0.251,5353 0/0 udp 5850
813786 1:56
192.168.198.108,5353 224.0.0.251,5353 0/0 udp 5850
813786 1:56
--
"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety." (Ben Franklin)
"The course of history shows that as a government grows, liberty
decreases." (Thomas Jefferson)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack
2012-02-15 14:00 ` conntrack Stephen Clark
@ 2012-02-15 14:27 ` Chris Wilson
0 siblings, 0 replies; 5+ messages in thread
From: Chris Wilson @ 2012-02-15 14:27 UTC (permalink / raw)
To: Stephen Clark; +Cc: Pablo Neira Ayuso, Netfilter Developer Mailing List
Hi Stephen,
On Wed, 15 Feb 2012, Stephen Clark wrote:
> I have been working with FreeBSD for about 10 years and using ipfilter. It
> has a neat tool ipfstat -t which show the state table
> sort of like top. It is very useful if someone is hogging the network because
> it is sorted by the highest user first. We are switching
> our systems to Linux and would like to know fs there anything like this for
> conntrack?
>
> Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes
>
> Source IP Destination IP ST PR #pkts #bytes
> ttl
> 192.168.198.105,5353 224.0.0.251,5353 0/0 udp 22598 3736235
> 1:57
iftop does something like this, not looking at the conntrack table but it
may help.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-02-15 14:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-14 12:48 conntrack Stephen Clark
2012-02-14 19:54 ` conntrack Pablo Neira Ayuso
2012-02-15 3:41 ` conntrack Stephen Clark
2012-02-15 14:00 ` conntrack Stephen Clark
2012-02-15 14:27 ` conntrack Chris Wilson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).