AW: OK the last one: IP Accounting

["yomega" <yomega@wahooo.net>]

Mornin ppl :)

Thx 4 all the nice answers, i think i got it now and i set up Accounting for
my POP3 Server.

Please take a look at this:

----------------------------------------------------------------------------
------------
Chain INPUT (policy ACCEPT 2576K packets, 358M bytes)
 pkts bytes target     prot opt in     out     source
destination

   48  2216 pop3       tcp  --  any    any     anywhere             anywhere
       tcp dpt:pop3
    0     0 pop3       udp  --  any    any     anywhere             anywhere
       udp dpt:pop3

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination


Chain OUTPUT (policy ACCEPT 2474K packets, 1492M bytes)
 pkts bytes target     prot opt in     out     source
destination

    0     0 pop3       udp  --  any    any     anywhere             anywhere
       udp spt:pop3
   43  8436 pop3       tcp  --  any    any     anywhere             anywhere
       tcp spt:pop3

Chain pop3 (4 references)
 pkts bytes target     prot opt in     out     source
destination

   40  1837            tcp  --  any    any     anywhere             anywhere
       tcp dpt:pop3
    0     0            udp  --  any    any     anywhere             anywhere
       udp dpt:pop3
    0     0            udp  --  any    any     anywhere             anywhere
       udp spt:pop3
    9   434            tcp  --  any    any     anywhere             anywhere
       tcp spt:pop3
----------------------------------------------------------------------------
------

Wohoo got a lit big... but i think i got all traffic passing my NIC... do u
think so too?


Nice morning, nice day :)

Greetings
Stephan


> -----Ursprungliche Nachricht-----
> Von: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org]Im Auftrag von Patrick Schaaf
>
>
> Yo Mega,
>
> > iptables -A httpd_accounting -p tcp --dport 80
> > iptables -A INPUT -p tcp --dport 80 -j httpd_accounting
> > iptables -A OUTPUT -p tcp --dport 80 -j httpd_accounting
> >
> > Now I'm finished !!?
>
> I don't think so.
>
> > You think this is OK?
>
> No.
>
> > Or do I count some traffic twice?
>
> No.
>
> > And, of course, have i counted ALL the traffic?
>
> No.
>
> You now count traffic from clients to your HTTP server, as well as
> packets from your server machine to OTHER HTTP servers.
>
> In the OUTPUT chain rule, change "--dport" to "--sport", and then you
> will be finished, and count both packets to and from your port 80.
> In general, when going from INPUT rules to OUTPUT rules for the same
> thing, switch sources and destinations.
>
> best regards
>   Patrick
>
>