Add packet statistics to ipset?

[Jonathan <jdccdevel@gmail.com>]

Hello:

How difficult would it be to add packet/byte counters to ipset?

I have a iptables ruleset that I'm looking to simplify, and I would like 
to use the ipset module. However, I also have a need to collect per-host 
byte counters. Currently I scrape them from the iptables output, but 
with ipset this is not possible afaik. This makes the ipset module 
(which I would _really_ like to use) useless for me.

I am not familiar with kernel programming, but I do know C. If it's not 
too difficult, I would be very interested in helping with implementing 
this, or even implementing it myself with some help.

Other options I have considered are adding some sort of ip-bitmap or 
hash support to the nfacct system, or an aggregation filter module for 
ulogd. From what I can tell, adding bitmaps/hashes to the nfacct system 
would be much more complicated, and adding an aggregation filter to 
ulogd would be far less efficient.

What do you think?

Jonathan deBoer