From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alexandru Coseru" Subject: nat & ip accounting Date: Wed, 26 Mar 2003 21:32:56 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004401c2f3ce$812d08e0$0200a8c0@lynx> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0041_01C2F3DF.44389290" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0041_01C2F3DF.44389290 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello.. I want to see using iptables -L -v the ammount of traffic generated by = each of my LAN's IP.. i have masq 192.168.0.2 to 192.168.0.50... and now i want to see the traffic generated by 192.168.0.4 since the = last reset of counters.. How can I do that ? I want to be able to see the download and the = upload ... Thanks.. Alex ------=_NextPart_000_0041_01C2F3DF.44389290 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello..

I want to see using iptables -L = -v the=20 ammount of traffic generated by each of my LAN's IP..

i have masq 192.168.0.2 to=20 192.168.0.50...

and now i want to see the traffic = generated by=20 192.168.0.4 since the last reset of counters..

How can I do that ? I want to be = able to see=20 the download and the upload ...

Thanks..

=20 = =20 Alex

------=_NextPart_000_0041_01C2F3DF.44389290-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kim Jensen Subject: Re: nat & ip accounting Date: Wed, 26 Mar 2003 22:01:59 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200303262201.59505.kimj@dawn.dk> References: <004401c2f3ce$812d08e0$0200a8c0@lynx> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <004401c2f3ce$812d08e0$0200a8c0@lynx> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Alexandru Coseru , netfilter@lists.netfilter.org On Wednesday 26 March 2003 20:32, Alexandru Coseru wrote: > Hello.. > > I want to see using iptables -L -v the ammount of traffic generated by > each of my LAN's IP.. > > i have masq 192.168.0.2 to 192.168.0.50... > > and now i want to see the traffic generated by 192.168.0.4 since the la= st > reset of counters.. > > How can I do that ? I want to be able to see the download and the uplo= ad > ... > ifconfig /Kim From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rowan Reid Subject: RE: nat & ip accounting Date: Wed, 26 Mar 2003 13:11:05 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001b01c2f3dc$37348a20$1001a8c0@s3ac> References: <200303262201.59505.kimj@dawn.dk> Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-reply-to: <200303262201.59505.kimj@dawn.dk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Kim Jensen' , 'Alexandru Coseru' , netfilter@lists.netfilter.org > > and now i want to see the traffic generated by 192.168.0.4 > since the > > last reset of counters.. > > > > How can I do that ? I want to be able to see the download and the > > upload ... I have an answer but you also got me thinking. A good tool to keep track of traffic via ip addresses would be mrtg. However is there an mrtg type tool that uses the counters in iptables rules to keep track of traffic and output it in a user friendly form. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bjorn Ruberg Subject: Re: nat & ip accounting Date: 26 Mar 2003 22:38:39 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1048714720.18872.13.camel@mikke> References: <004401c2f3ce$812d08e0$0200a8c0@lynx> <200303262201.59505.kimj@dawn.dk> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <200303262201.59505.kimj@dawn.dk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: netfilter@lists.netfilter.org On Wed, 2003-03-26 at 22:01, Kim Jensen wrote: > On Wednesday 26 March 2003 20:32, Alexandru Coseru wrote: > > Hello.. > > > > I want to see using iptables -L -v the ammount of traffic generated by > > each of my LAN's IP.. > > > > i have masq 192.168.0.2 to 192.168.0.50... > > > > and now i want to see the traffic generated by 192.168.0.4 since the la= st > > reset of counters.. > > > > How can I do that ? I want to be able to see the download and the uplo= ad > > ... > > > ifconfig ifconfig is the worst alternative, because it regularly resets its counters. As Rowan suggested, use MRTG [1] or some other tool (RRDtool [2], perhaps? :) to read the statistics. You may use MRTG with an SNMP daemon on your system or with an iptables extract script [3]. Hope this helps; Bj=F8rn [1] http://www.mrtg.org/ [2] http://www.rrdtool.org/ [3] http://www.norris160.org/cisco/MRTG_Monitor_Software.htm From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kim Jensen Subject: Re: nat & ip accounting Date: Wed, 26 Mar 2003 22:51:45 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200303262251.45912.kimj@dawn.dk> References: <001b01c2f3dc$37348a20$1001a8c0@s3ac> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <001b01c2f3dc$37348a20$1001a8c0@s3ac> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Rowan Reid , 'Alexandru Coseru' , netfilter@lists.netfilter.org On Wednesday 26 March 2003 22:11, Rowan Reid wrote: > I have an answer but you also got me thinking. A good tool to keep > track of traffic via ip addresses would be mrtg. However is there an > mrtg type tool that uses the counters in iptables rules to keep track o= f > traffic and output it in a user friendly form. If you wish to see things in a more user friendly way (or usable way, as = no=20 system is friendly :-) can be hard as you have to define what in what you= =20 wish to see things! mrtg is quite good, since you get the results on a webpage, but for track= ing=20 ip specific things - I don't know, as I don't think the kernel remembers = this=20 statistic. You can read per interface but not from each ip connecting to = an=20 interface. /Kim From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rowan Reid Subject: RE: nat & ip accounting Date: Wed, 26 Mar 2003 15:04:34 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000701c2f3ec$1153ef20$1001a8c0@s3ac> References: <000f01c2f3e6$8afbca60$0200a8c0@lynx> Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-reply-to: <000f01c2f3e6$8afbca60$0200a8c0@lynx> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Alexandru Coseru' Cc: netfilter@lists.samba.org > > I've tried an mtrg , but no luck.. it's telling me only > about the whole eth0 ... no traffic per ip basis.. Mrtg configures via snmp when I set it up I have a page for each ineterface Ip. So I can see my external address and internal address traffic. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kim Jensen Subject: Re: nat & ip accounting Date: Wed, 26 Mar 2003 23:47:43 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200303262347.43496.kimj@dawn.dk> References: <004401c2f3ce$812d08e0$0200a8c0@lynx> <200303262201.59505.kimj@dawn.dk> <1048714720.18872.13.camel@mikke> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1048714720.18872.13.camel@mikke> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Bjorn Ruberg , netfilter@lists.netfilter.org On Wednesday 26 March 2003 22:38, Bjorn Ruberg wrote: > On Wed, 2003-03-26 at 22:01, Kim Jensen wrote: > > On Wednesday 26 March 2003 20:32, Alexandru Coseru wrote: > > > Hello.. > > > > > > I want to see using iptables -L -v the ammount of traffic generate= d by > > > each of my LAN's IP.. > > > > > > i have masq 192.168.0.2 to 192.168.0.50... > > > > > > and now i want to see the traffic generated by 192.168.0.4 since th= e > > > last reset of counters.. > > > > > > How can I do that ? I want to be able to see the download and the > > > upload ... > > > > ifconfig > > ifconfig is the worst alternative, because it regularly resets its > counters. > > As Rowan suggested, use MRTG [1] or some other tool (RRDtool [2], > perhaps? :) to read the statistics. > > You may use MRTG with an SNMP daemon on your system or with an iptables > extract script [3]. > Well, I tried to be a little provocative with my remark on ifconfig - see= ms=20 like it worked. MRTH is a much preferred tool. If the problem is that cer= tain=20 persons are having a very high load, then use host based limiting rules. /Kim From mboxrd@z Thu Jan 1 00:00:00 1970 From: alexb@atix.com.br Subject: Re: nat & ip accounting Date: Wed, 26 Mar 2003 19:51:26 -0300 (BRT) Sender: netfilter-admin@lists.netfilter.org Message-ID: <1048719086.3e822eeeb4d7e@www.spsul.com.br> References: <001b01c2f3dc$37348a20$1001a8c0@s3ac> <200303262251.45912.kimj@dawn.dk> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <200303262251.45912.kimj@dawn.dk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: netfilter@lists.netfilter.org If you havn't to many diferent ip/ip-ranges to monitor you can enter iptabl= es filter rules for that ips with no action, just to count the trafic, than us= e a script and mrtg to show them. something like: iptables -A FORWARD -s [MonitoredIP] -i [NIC_conecting_to_IP] iptables -A FORWARD -d {MonitoredIP] -o [NIC_conecting_to_IP] make a script to grab the bytecount and output them as mrtg expect (IN,OUT,UPTIME,HOSTNAME). Change ^[1,2] to select your rules in the chain where you grab the trafic. iptables -nvxL FORWARD --line-numbers|egrep ^[1,2]|awk '{print $3}' C=F3pia Kim Jensen : > On Wednesday 26 March 2003 22:11, Rowan Reid wrote: > > I have an answer but you also got me thinking. A good tool to keep > > track of traffic via ip addresses would be mrtg. However is there an > > mrtg type tool that uses the counters in iptables rules to keep track > of > > traffic and output it in a user friendly form. >=20 > If you wish to see things in a more user friendly way (or usable way, as > no=20 > system is friendly :-) can be hard as you have to define what in what > you=20 > wish to see things! >=20 > mrtg is quite good, since you get the results on a webpage, but for > tracking=20 > ip specific things - I don't know, as I don't think the kernel remembers > this=20 > statistic. You can read per interface but not from each ip connecting to > an=20 > interface. >=20 > /Kim >=20 >=20 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bjorn Ruberg Subject: Re: nat & ip accounting Date: 27 Mar 2003 00:17:54 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1048720674.18872.19.camel@mikke> References: <001b01c2f3dc$37348a20$1001a8c0@s3ac> <200303262251.45912.kimj@dawn.dk> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <200303262251.45912.kimj@dawn.dk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: netfilter@lists.netfilter.org On Wed, 2003-03-26 at 22:51, Kim Jensen wrote: > On Wednesday 26 March 2003 22:11, Rowan Reid wrote: > > I have an answer but you also got me thinking. A good tool to keep > > track of traffic via ip addresses would be mrtg. However is there an > > mrtg type tool that uses the counters in iptables rules to keep track o= f > > traffic and output it in a user friendly form. >=20 > If you wish to see things in a more user friendly way (or usable way, as = no=20 > system is friendly :-) can be hard as you have to define what in what you= =20 > wish to see things! >=20 > mrtg is quite good, since you get the results on a webpage, but for track= ing=20 > ip specific things - I don't know, as I don't think the kernel remembers = this=20 > statistic. You can read per interface but not from each ip connecting to = an=20 > interface. You can indeed log from each IP connecting. In fact you may read whatever you configure iptables to log. You may end up with one heck of a ruleset, as you need one iptables rule for every different parameter you want to log. Bj=F8rn From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bjorn Ruberg Subject: Re: nat & ip accounting Date: 27 Mar 2003 00:37:53 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1048721873.18895.33.camel@mikke> References: <004401c2f3ce$812d08e0$0200a8c0@lynx> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <004401c2f3ce$812d08e0$0200a8c0@lynx> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: netfilter@lists.netfilter.org On Wed, 2003-03-26 at 20:32, Alexandru Coseru wrote: >=20 >=20 > Hello.. >=20 > I want to see using iptables -L -v the ammount of traffic generated by e= ach of my LAN's IP.. >=20 > i have masq 192.168.0.2 to 192.168.0.50... >=20 > and now i want to see the traffic generated by 192.168.0.4 since the last= reset of counters.. >=20 > How can I do that ? I want to be able to see the download and the upload= ... You will need to create an iptables rule for the specific IP, one for outgoing and one for incoming traffic. Iptables is not able to give you this information if you have not instructed it to store the specific IP's connection. First the rules, then the statistics. For your future logging requirements: iptables -A FORWARD -d 192.168.0.4 -j RETURN iptables -A FORWARD -s 192.168.0.4 -j RETURN will create two new lines of traffic statistics to read from when running "iptables -L -v", giving you information to and from the given host, respectively. Be sure to put them somewhere early in your rule set. The RETURN target passes the packets back to the rest of the iptables rule set after having counted them. Thus, these lines do not affect the functionality of your iptables rules. Bj=F8rn From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bjorn Ruberg Subject: Re: nat & ip accounting Date: 27 Mar 2003 00:50:46 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1048722647.18895.39.camel@mikke> References: <004401c2f3ce$812d08e0$0200a8c0@lynx> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <004401c2f3ce$812d08e0$0200a8c0@lynx> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: netfilter@lists.netfilter.org Oops, a little error in my last posting. Do NOT use the RETURN target on the default chain. The RETURN target (obviously) returns the packets to the chain that sent it there. If used in the main chain, it is the same as falling back to the default behaviour of the chain and will hopefully be denied. Therefore, a direction to a chain must be done. iptables -N count_in iptables -A count_in -j RETURN iptables -N count_out iptables -A count_out -j RETURN iptables -A FORWARD -s 192.168.0.4 -j count_in iptables -A FORWARD -d 192.168.0.4 -j count_out will do the trick. Bj=F8rn From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kelly Setzer Subject: Re: nat & ip accounting Date: Thu, 27 Mar 2003 09:04:53 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030327150453.GA2765@placemark.com> References: <000f01c2f3e6$8afbca60$0200a8c0@lynx> <000701c2f3ec$1153ef20$1001a8c0@s3ac> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <000701c2f3ec$1153ef20$1001a8c0@s3ac> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Rowan Reid Cc: 'Alexandru Coseru' , netfilter@lists.samba.org On Wed, Mar 26, 2003 at 03:04:34PM -0800, Rowan Reid wrote: > > > > > I've tried an mtrg , but no luck.. it's telling me only > > about the whole eth0 ... no traffic per ip basis.. IP Audit might have what you need. http://sp.uconn.edu/~jrifkin/ipaudit/ Kelly -- Kelly Setzer, System Administrator/Architect - Placemark Investments 14180 Dallas Pkwy, Suite 200, Dallas, TX 75240 kelly.setzer@placemark.com http://www.placemark.com (972)404-8100x41 (work) (214) 287-3464 (cell)