advanced ip accounting

advanced ip accounting

[Martin Tomasek]

[-- Attachment #1: Type: text/plain, Size: 486 bytes --]

Hello all,

I'm looking for some accounting for netfilter, which should be used like
this:

iptables -A FORWARD -s 1.2.0.0/16 -j ACCOUNTING

and which sends data to userspace periodically. It should collect 
protocol-ips-ports triplets, for which it will count bytes.
I could't use -j ULOG or pcap because of big overhead -- I want to use
it on gigabit router.

Have you seen something like this?

-- 
Martin Tomasek, mtd@email.cz
BOFH excuse #175:
OS swapped to disk

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: advanced ip accounting

[Jan Humme]

On Friday 05 July 2002 09:45, Martin Tomasek wrote:
> Hello all,
>
> I'm looking for some accounting for netfilter, which should be used like
> this:
>
> iptables -A FORWARD -s 1.2.0.0/16 -j ACCOUNTING
>
> and which sends data to userspace periodically. It should collect
> protocol-ips-ports triplets, for which it will count bytes.
> I could't use -j ULOG or pcap because of big overhead -- I want to use
> it on gigabit router.
>
> Have you seen something like this?

How about using the "IP accounting" facility of iptables? Try:

#iptables -A FORWARD -s 1.2.0.0/16

i.e. without the -j option, to create a counter, and use

#iptables -L -v

to read out the results.

#iptables -Z 

to reset.

You can make similar entries to count by service port.

Jan Humme.

Re: advanced ip accounting

[Wiktor Wodecki]

[-- Attachment #1: Type: text/plain, Size: 607 bytes --]

On Fri, Jul 05, 2002 at 01:00:09PM +0200, Jan Humme wrote:
> On Friday 05 July 2002 09:45, Martin Tomasek wrote:
> > Hello all,
> > I'm looking for some accounting for netfilter, which should be used like
> > this:
> > iptables -A FORWARD -s 1.2.0.0/16 -j ACCOUNTING
> #iptables -A FORWARD -s 1.2.0.0/16
> i.e. without the -j option, to create a counter, and use

this doesn't give you detailed information about every IP, only for the
whole subnet...but the original poster might want to look at http://lwn.net/Articles/2718/

-- 

Regards,

Wiktor Wodecki <w.wodecki@manfred-dahlhoff.de>

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: advanced ip accounting

[Martin Tomasek]

[-- Attachment #1: Type: text/plain, Size: 924 bytes --]

> How about using the "IP accounting" facility of iptables? Try:
> 
> #iptables -A FORWARD -s 1.2.0.0/16
> 
> i.e. without the -j option, to create a counter, and use
> 
> #iptables -L -v
> 
> to read out the results.

Thanks, but you are writing about something different.

Counters are good, but I must
be able to see for all ips byte counts on any port or protocol, which
is specified _after_ byte counts are recorded. I must store it into
database and select specific port, ip and/or protocol by database query.

So I'm asking about accounting _target_, which will allow me to collect
all the data without sending one packet to userspace immediately after
rule matches (as -j ULOG does). pcap is unusable for me too.

I heard, that something like this exists (or existed ;-), but couldn't
find anything about it.

-- 
Martin Tomasek, mtd@email.cz
BOFH excuse #30:
positron router malfunction

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]