how to add packet or byte couters to connection tracking module

how to add packet or byte couters to connection tracking module

[Xuan Chen]

Hi,

I want to add a packet or byte counter to the connection tracking module 
in netfilter. That is, I want to track how many packets and bytes having 
been sent through one connection. Where should I start? Any examples will 
be very helpful!

btw, is there a search engine on netfilter's web page? I think that's 
really helpful if people want to search for previous work and discussions.

Thanks,
-chen

-- 
Xuan Chen
USC/ISI

Re: how to add packet or byte couters to connection tracking module

[Patrick Schaaf]

> I want to add a packet or byte counter to the connection tracking module 
> in netfilter. That is, I want to track how many packets and bytes having 
> been sent through one connection. Where should I start?

1) Get the kernel source code.

2) Get enough RAM to hold the full kernel source code, and your normal apps.
   To test whether you have enough RAM, use 'vmstat' to see whether you
   start swapping on this command:
	find /usr/src/linux -type f | grep -l 'struct ip_conntrack'

3) you are set up for work with the kernel. "grep for this" is the
   basic navigation aid. Now that you have found the include file
   (they end in '.h') where 'struct ip_conntrack' is defined,
   add the neccessary counter fields to it.

4) Study the other files the find/grep above found, especially the files
   with 'conntrack' in their names. Add the counter updates to the
   relevant files.

5) Provide ways for userlevel to access those counters. I would be
   interested to hear about the access methods you imagine.

6) Test. Test. Test.

> Any examples will be very helpful!

A concrete example, would mean writing the code. I hope you persist
and implement and share your code, because if you do, we will have
an example. I hope my six step program, above, helps you along a bit.
 
> btw, is there a search engine on netfilter's web page? I think that's 
> really helpful if people want to search for previous work and discussions.

I'm sure that google has it indexed fully; use the advanced search
features, there, to restrict any search to a particular domain.
An example URL, searching for "byte counters" on www.netfilter.org,
would be:

	http://www.google.com/search?q=+site%3Awww.netfilter.org+byte+counters

best regards
  Patrick

Re: how to add packet or byte couters to connection tracking module

[Patrick McHardy]

Xuan Chen wrote:

>Hi,
>
>I want to add a packet or byte counter to the connection tracking module 
>in netfilter. That is, I want to track how many packets and bytes having 
>been sent through one connection. Where should I start? Any examples will 
>be very helpful!
>
>btw, is there a search engine on netfilter's web page? I think that's 
>really helpful if people want to search for previous work and discussions.
>
>Thanks,
>-chen
>
>  
>

http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=conntrack+match+bytes+per+connection&btnG=Google+Search
Doesn't apply clean to 2.4.20 iirc, but very easy to fix.

Patrick

Re: how to add packet or byte couters to connection tracking module

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 918 bytes --]

On Thu, Feb 20, 2003 at 07:33:40PM +0100, Patrick Schaaf wrote:
> > I want to add a packet or byte counter to the connection tracking module 
> > in netfilter. That is, I want to track how many packets and bytes having 
> > been sent through one connection. Where should I start?
> 
> 1) Get the kernel source code.
> 
> [...] 

*lol*

> 5) Provide ways for userlevel to access those counters. I would be
>    interested to hear about the access methods you imagine.

ctnetlink should do the trick.

> best regards
>   Patrick

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]