* conntrack @ 2012-02-14 12:48 Stephen Clark 2012-02-14 19:54 ` conntrack Pablo Neira Ayuso 0 siblings, 1 reply; 5+ messages in thread From: Stephen Clark @ 2012-02-14 12:48 UTC (permalink / raw) To: Netfilter Developer Mailing List Hi, Does connection tracking keep any counters on number of packets/and or bytes that are associated with a connection? If so how does one access them? Thanks, Steve -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson) ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack 2012-02-14 12:48 conntrack Stephen Clark @ 2012-02-14 19:54 ` Pablo Neira Ayuso 2012-02-15 3:41 ` conntrack Stephen Clark 2012-02-15 14:00 ` conntrack Stephen Clark 0 siblings, 2 replies; 5+ messages in thread From: Pablo Neira Ayuso @ 2012-02-14 19:54 UTC (permalink / raw) To: Stephen Clark; +Cc: Netfilter Developer Mailing List On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote: > Hi, > > Does connection tracking keep any counters on number of packets/and > or bytes that are > associated with a connection? If so how does one access them? echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct Then, you can access them via: conntrack -L ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack 2012-02-14 19:54 ` conntrack Pablo Neira Ayuso @ 2012-02-15 3:41 ` Stephen Clark 2012-02-15 14:00 ` conntrack Stephen Clark 1 sibling, 0 replies; 5+ messages in thread From: Stephen Clark @ 2012-02-15 3:41 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Netfilter Developer Mailing List On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote: > On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote: > >> Hi, >> >> Does connection tracking keep any counters on number of packets/and >> or bytes that are >> associated with a connection? If so how does one access them? >> > echo 1> /proc/sys/net/netfilter/nf_conntrack_acct > > Then, you can access them via: > > conntrack -L > > Thanks -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson) ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack 2012-02-14 19:54 ` conntrack Pablo Neira Ayuso 2012-02-15 3:41 ` conntrack Stephen Clark @ 2012-02-15 14:00 ` Stephen Clark 2012-02-15 14:27 ` conntrack Chris Wilson 1 sibling, 1 reply; 5+ messages in thread From: Stephen Clark @ 2012-02-15 14:00 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Netfilter Developer Mailing List On 02/14/2012 02:54 PM, Pablo Neira Ayuso wrote: > On Tue, Feb 14, 2012 at 07:48:10AM -0500, Stephen Clark wrote: > >> Hi, >> >> Does connection tracking keep any counters on number of packets/and >> or bytes that are >> associated with a connection? If so how does one access them? >> > echo 1> /proc/sys/net/netfilter/nf_conntrack_acct > > Then, you can access them via: > > conntrack -L > > Hi Pablo, I have been working with FreeBSD for about 10 years and using ipfilter. It has a neat tool ipfstat -t which show the state table sort of like top. It is very useful if someone is hogging the network because it is sorted by the highest user first. We are switching our systems to Linux and would like to know fs there anything like this for conntrack? Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes Source IP Destination IP ST PR #pkts #bytes ttl 192.168.198.105,5353 224.0.0.251,5353 0/0 udp 22598 3736235 1:57 10.0.254.32,631 10.0.255.255,631 0/0 udp 11872 2623712 1:29 192.168.198.103,5353 224.0.0.251,5353 0/0 udp 10608 1720665 1:56 192.168.198.103,5353 224.0.0.251,5353 0/0 udp 10608 1720665 1:56 10.0.254.32,5353 224.0.0.251,5353 0/0 udp 9807 1680621 1:56 10.0.254.32,5353 224.0.0.251,5353 0/0 udp 9806 1680485 1:56 192.168.198.166,50676 192.168.198.75,8181 4/4 tcp 2412 1548504 81:09:04 192.168.198.148,137 192.168.198.255,137 0/0 udp 18625 1452750 1:51 10.0.254.32,631 10.0.255.255,631 0/0 udp 6082 1344122 1:29 192.168.198.148,137 192.168.198.255,137 0/0 udp 14186 1107048 1:51 10.0.129.11,5353 224.0.0.251,5353 0/0 udp 5841 1016739 1:56 10.0.129.11,5353 224.0.0.251,5353 0/0 udp 5840 1016566 1:56 192.168.198.148,137 192.168.198.255,137 0/0 udp 12427 969306 1:51 10.0.133.2,34114 216.17.35.103,143 4/4 tcp 13118 852888 119:59:36 192.168.198.105,5353 224.0.0.251,5353 0/0 udp 3790 828335 1:57 192.168.198.8,5353 224.0.0.251,5353 0/0 udp 5856 826713 1:57 192.168.198.8,5353 224.0.0.251,5353 0/0 udp 5856 826713 1:57 192.168.198.108,5353 224.0.0.251,5353 0/0 udp 5850 813786 1:56 192.168.198.108,5353 224.0.0.251,5353 0/0 udp 5850 813786 1:56 -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson) ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: conntrack 2012-02-15 14:00 ` conntrack Stephen Clark @ 2012-02-15 14:27 ` Chris Wilson 0 siblings, 0 replies; 5+ messages in thread From: Chris Wilson @ 2012-02-15 14:27 UTC (permalink / raw) To: Stephen Clark; +Cc: Pablo Neira Ayuso, Netfilter Developer Mailing List Hi Stephen, On Wed, 15 Feb 2012, Stephen Clark wrote: > I have been working with FreeBSD for about 10 years and using ipfilter. It > has a neat tool ipfstat -t which show the state table > sort of like top. It is very useful if someone is hogging the network because > it is sorted by the highest user first. We are switching > our systems to Linux and would like to know fs there anything like this for > conntrack? > > Src: 0.0.0.0, Dest: 0.0.0.0, Proto: any, Sorted by: # bytes > > Source IP Destination IP ST PR #pkts #bytes > ttl > 192.168.198.105,5353 224.0.0.251,5353 0/0 udp 22598 3736235 > 1:57 iftop does something like this, not looking at the conntrack table but it may help. Cheers, Chris. -- Aptivate | http://www.aptivate.org | Phone: +44 1223 760887 The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES Aptivate is a not-for-profit company registered in England and Wales with company number 04980791. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-02-15 14:49 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-02-14 12:48 conntrack Stephen Clark 2012-02-14 19:54 ` conntrack Pablo Neira Ayuso 2012-02-15 3:41 ` conntrack Stephen Clark 2012-02-15 14:00 ` conntrack Stephen Clark 2012-02-15 14:27 ` conntrack Chris Wilson
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).