OK the last one: IP Accounting

OK the last one: IP Accounting

[yomega]

Hi List,

sorry 4 bothering you once again :) But tonight in my nice and warm little
bed my IP-Traffic Accounting Question Brain stood up once again :)

For Example, i wanna count the Traffic of my HTTPD so its only Port 80, not
other HTTPS Stuff or such its just an easy one :) Now my thoughts:

1. I Add a chain, httpd_accounting
2. I Add a rule @ httpd_accounting on port 80, no matter if its Input or
Ouput just this:

iptables -A httpd_accounting -p tcp --dport 80

2. At the Input Chain i add an Rule for Port 80 that Jumps to
httpd_accounting

iptables -A INPUT -p tcp --dport 80 -j httpd_accounting

So my INPUT traffic is now ready 4 counting.

3. Now the Output Traffic has to be counted, same thing but:

iptables -A OUTPUT -p tcp --dport 80 -j httpd_accounting

Now I'm finished !!?

You think this is OK? Or do I count some traffic twice? And, of course, have
i counted ALL the traffic?

Thx 4 all nice ppl reading my stupid question :o)

Greetz,
yomega

Re: OK the last one: IP Accounting

[Patrick Schaaf]

Yo Mega,

> iptables -A httpd_accounting -p tcp --dport 80
> iptables -A INPUT -p tcp --dport 80 -j httpd_accounting
> iptables -A OUTPUT -p tcp --dport 80 -j httpd_accounting
> 
> Now I'm finished !!?

I don't think so.

> You think this is OK?

No.

> Or do I count some traffic twice?

No.

> And, of course, have i counted ALL the traffic?

No.

You now count traffic from clients to your HTTP server, as well as
packets from your server machine to OTHER HTTP servers.

In the OUTPUT chain rule, change "--dport" to "--sport", and then you
will be finished, and count both packets to and from your port 80.
In general, when going from INPUT rules to OUTPUT rules for the same
thing, switch sources and destinations.

best regards
  Patrick

AW: OK the last one: IP Accounting

[yomega]

Mornin ppl :)

Thx 4 all the nice answers, i think i got it now and i set up Accounting for
my POP3 Server.

Please take a look at this:

----------------------------------------------------------------------------
------------
Chain INPUT (policy ACCEPT 2576K packets, 358M bytes)
 pkts bytes target     prot opt in     out     source
destination

   48  2216 pop3       tcp  --  any    any     anywhere             anywhere
       tcp dpt:pop3
    0     0 pop3       udp  --  any    any     anywhere             anywhere
       udp dpt:pop3

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination


Chain OUTPUT (policy ACCEPT 2474K packets, 1492M bytes)
 pkts bytes target     prot opt in     out     source
destination

    0     0 pop3       udp  --  any    any     anywhere             anywhere
       udp spt:pop3
   43  8436 pop3       tcp  --  any    any     anywhere             anywhere
       tcp spt:pop3

Chain pop3 (4 references)
 pkts bytes target     prot opt in     out     source
destination

   40  1837            tcp  --  any    any     anywhere             anywhere
       tcp dpt:pop3
    0     0            udp  --  any    any     anywhere             anywhere
       udp dpt:pop3
    0     0            udp  --  any    any     anywhere             anywhere
       udp spt:pop3
    9   434            tcp  --  any    any     anywhere             anywhere
       tcp spt:pop3
----------------------------------------------------------------------------
------

Wohoo got a lit big... but i think i got all traffic passing my NIC... do u
think so too?


Nice morning, nice day :)

Greetings
Stephan


> -----Ursprungliche Nachricht-----
> Von: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org]Im Auftrag von Patrick Schaaf
>
>
> Yo Mega,
>
> > iptables -A httpd_accounting -p tcp --dport 80
> > iptables -A INPUT -p tcp --dport 80 -j httpd_accounting
> > iptables -A OUTPUT -p tcp --dport 80 -j httpd_accounting
> >
> > Now I'm finished !!?
>
> I don't think so.
>
> > You think this is OK?
>
> No.
>
> > Or do I count some traffic twice?
>
> No.
>
> > And, of course, have i counted ALL the traffic?
>
> No.
>
> You now count traffic from clients to your HTTP server, as well as
> packets from your server machine to OTHER HTTP servers.
>
> In the OUTPUT chain rule, change "--dport" to "--sport", and then you
> will be finished, and count both packets to and from your port 80.
> In general, when going from INPUT rules to OUTPUT rules for the same
> thing, switch sources and destinations.
>
> best regards
>   Patrick
>
>

Re: AW: OK the last one: IP Accounting

[Antony Stone]

On Sunday 23 June 2002 9:10 am, yomega wrote:

> Mornin ppl :)
>
> Thx 4 all the nice answers, i think i got it now and i set up Accounting
> for my POP3 Server.
>
> Please take a look at this:

You could get rid of the UDP stuff.   POP3 will never use UDP packets.

 

Antony.

AW: AW: OK the last one: IP Accounting

[yomega]

Hi,

thx Antony thx Patrik :o)

Because of you: Now i'm ready to count all packages

*startsdancin*

THANK YOU MUUUUCH :)

Greets,
yomega

> -----Ursprüngliche Nachricht-----
> Von: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org]Im Auftrag von Antony Stone
> Gesendet: Sonntag, 23. Juni 2002 10:09
> An: netfilter@lists.samba.org
> Betreff: Re: AW: OK the last one: IP Accounting
>
>
> On Sunday 23 June 2002 9:10 am, yomega wrote:
>
> > Mornin ppl :)
> >
> > Thx 4 all the nice answers, i think i got it now and i set up Accounting
> > for my POP3 Server.
> >
> > Please take a look at this:
>
> You could get rid of the UDP stuff.   POP3 will never use UDP packets.
>
>
>
> Antony.
>
>

Re: AW: OK the last one: IP Accounting

[Patrick Schaaf]

Yo,

one more thing WRT accounting POP3, and just as an idea that may be
useful for you in the future: if your pop3 server software changes
its uid to the user served, or if you set up several independant
pop3 servers running under different uids, you can use the "owner"
match extension to iptables to easily seperate accounting based
on the uids. You can do this inside the pop3_accounting chain,
without touching the main chains again.

Isn't this nice?

all the best
  Patrick

AW: AW: OK the last one: IP Accounting

[yomega]

Hi,

yeah this is :o))

thx in advance 

greetz,
yomega

> -----Ursprungliche Nachricht-----
> Von: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org]Im Auftrag von Patrick Schaaf
> Gesendet: Sonntag, 23. Juni 2002 10:33
> An: yomega
> Cc: netfilter@lists.samba.org
> Betreff: Re: AW: OK the last one: IP Accounting
> 
> 
> Yo,
> 
> one more thing WRT accounting POP3, and just as an idea that may be
> useful for you in the future: if your pop3 server software changes
> its uid to the user served, or if you set up several independant
> pop3 servers running under different uids, you can use the "owner"
> match extension to iptables to easily seperate accounting based
> on the uids. You can do this inside the pop3_accounting chain,
> without touching the main chains again.
> 
> Isn't this nice?
> 
> all the best
>   Patrick
> 
> 

Re: OK the last one: IP Accounting

[Patrick Schaaf]

> Thx 4 all the nice answers, i think i got it now and i set up Accounting for
> my POP3 Server.

Looks good, but drop the "udp" rules. POP3 is not udp. Even if your
/etc/services suggests otherwise.

all the best
  Patrick