Conntrackd and Stats

Conntrackd and Stats

[Adam N.]

Hello everyone,
At the beginning I would like to thank everyone for the work put into 
the project netfilter.

We use conntrackd projekt to save NAT connections. Recently we noticed 
that with the change of the kernel version also changed format logs( 
disappeared amount of transferred packets and bytes).

My question is:
Is it possible to restore the record containing the number of packets 
and bytes transferred in connection?

Thanks,
Adam N.

Re: Conntrackd and Stats

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 766 bytes --]

Hi,

Le jeudi 01 août 2013 à 09:46 +0200, Adam N. a écrit :
> Hello everyone,
> At the beginning I would like to thank everyone for the work put into 
> the project netfilter.

Thanks Adam :)

> We use conntrackd projekt to save NAT connections. Recently we noticed 
> that with the change of the kernel version also changed format logs( 
> disappeared amount of transferred packets and bytes).
> 
> My question is:
> Is it possible to restore the record containing the number of packets 
> and bytes transferred in connection?

You can do
echo "1" > /proc/sys/net/netfilter/nf_conntrack_acct

If you want to have start time of the conntrack entries, you can also do

echo "1" > /proc/sys/net/netfilter/nf_conntrack_timestamp

BR,
--
Eric

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 190 bytes --]

Re: Conntrackd and Stats

[Adam N.]

W dniu 01.08.2013 10:31, Eric Leblond napisał(a):

> Hi,
> 
> Le jeudi 01 août 2013 à 09:46 +0200, Adam N. a écrit :
> 
>> Hello everyone, At the beginning I would like to thank everyone for 
>> the work put into the project netfilter.
> 
> Thanks Adam :)
> 
>> We use conntrackd projekt to save NAT connections. Recently we noticed 
>> that with the change of the kernel version also changed format logs( 
>> disappeared amount of transferred packets and bytes). My question is: 
>> Is it possible to restore the record containing the number of packets 
>> and bytes transferred in connection?
> 
> You can do
> echo "1" > /proc/sys/net/netfilter/nf_conntrack_acct
> 
> If you want to have start time of the conntrack entries, you can also 
> do
> 
> echo "1" > /proc/sys/net/netfilter/nf_conntrack_timestamp

Thank you very much
you know in what version of the kernel was presented 
nf_conntrack_timestamp?

In order not to ask unnecessary questions in the future, are somewhere 
information about such changes, except for the kernel sources :)

Pozdrawiam,
Adam N.

Re: Conntrackd and Stats

[Pablo Neira Ayuso]

On Thu, Aug 01, 2013 at 11:23:09AM +0200, Adam N. wrote:
> W dniu 01.08.2013 10:31, Eric Leblond napisał(a):
> 
> >Hi,
> >
> >Le jeudi 01 août 2013 à 09:46 +0200, Adam N. a écrit :
> >
> >>Hello everyone, At the beginning I would like to thank everyone
> >>for the work put into the project netfilter.
> >
> >Thanks Adam :)
> >
> >>We use conntrackd projekt to save NAT connections. Recently we
> >>noticed that with the change of the kernel version also changed
> >>format logs( disappeared amount of transferred packets and
> >>bytes). My question is: Is it possible to restore the record
> >>containing the number of packets and bytes transferred in
> >>connection?
> >
> >You can do
> >echo "1" > /proc/sys/net/netfilter/nf_conntrack_acct
> >
> >If you want to have start time of the conntrack entries, you can
> >also do
> >
> >echo "1" > /proc/sys/net/netfilter/nf_conntrack_timestamp
> 
> Thank you very much
> you know in what version of the kernel was presented
> nf_conntrack_timestamp?
> 
> In order not to ask unnecessary questions in the future, are
> somewhere information about such changes, except for the kernel
> sources :)

See Documentation/networking/nf_conntrack-sysctl.txt in recent
kernels.

Kernel timestamping is there since 2.6.39. Accounting for conntrack
since long time ago (I can find it in 2.6.27 as an optional
extension that you can enable on demand via /proc interface).

Regards.