Skip to contentSkip to conversation

Native support of counting rules?

DISCUSSION Aaron Lewis 5 participants 11 messages Jan 2, 2013 – Jan 4, 2013

lore
Share & tools
lore

Aaron Lewis

author
#0 lore raw

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

Signature · 3 lines
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://pgp.mit.edu/ )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
#1 lore raw

Hey Aaron,

I feel kind of odd but this should answer you:
http://linux.die.net/man/8/iptables
www.garron.me/linux/iptables-manual.html

Eliezer

Quoted 10 lines · Aaron Lewis

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

author
#2 lore raw

Already checked the manual on my system ... there's no counting support, the only thing relevant was --line-numbers,

My code is here, for anyone who needed

https://raw.github.com/CaledoniaProject/ipt_counting/master/ipt-count.c

I just hope one day such feature would be included officially.

Quoted 22 lines · Eliezer Croitoru

Hey Aaron,

I feel kind of odd but this should answer you:
http://linux.die.net/man/8/iptables
www.garron.me/linux/iptables-manual.html

Eliezer

Quoted 11 lines · Aaron Lewis

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

Signature · 3 lines
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
#3 lore raw

Hi,

why dont you use ...
iptables-save | grep "\-A" | wc -l

lg
~Jan

Quoted 36 lines · Aaron Lewis

Already checked the manual on my system ... there's no counting support, the only thing relevant was --line-numbers,

My code is here, for anyone who needed

https://raw.github.com/CaledoniaProject/ipt_counting/master/ipt-count.c

I just hope one day such feature would be included officially.

Quoted 22 lines · Eliezer Croitoru

Hey Aaron,

I feel kind of odd but this should answer you:
http://linux.die.net/man/8/iptables
www.garron.me/linux/iptables-manual.html

Eliezer

Quoted 11 lines · Aaron Lewis

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

#4 lore raw
Quoted 4 lines · Jan Vales

Hi,

why dont you use ...
iptables-save | grep "\-A" | wc -l

grep ^-A

But the foremost question is: how is the rule count alone going to be useful?

#5 lore raw
Quoted 4 lines · Jan Engelhardt
Quoted 2 lines · Jan Vales

Hi,

Quoted 8 lines
Quoted 2 lines

why dont you use ...
iptables-save | grep "\-A" | wc -l

grep ^-A

But the foremost question is: how is the rule count alone going to be useful?

I dont think its useful at all - I just like stats and wanted to help ;)

Especially with OP's requirement to allow non-root users to view this count. Therefore know that/when you changed something.

lg
~Jan

#6 lore raw
Quoted 10 lines · On 03.01.2013 18:27, [email protected] wrote:
Quoted 9 lines · Jan Engelhardt
Quoted 4 lines · Jan Vales

Hi,

why dont you use ...
iptables-save | grep "\-A" | wc -l

grep ^-A

Quoted 8 lines
Quoted 3 lines

But the foremost question is: how is the rule count alone going to be useful?

I dont think its useful at all - I just like stats and wanted to help ;)

Especially with OP's requirement to allow non-root users to view this count. Therefore know that/when you changed something.

you can swap the whole ruleset, as long as the total count of rules stays the same, this test won't detect it, therefore is totally unreliable. Nothing but stats, yes.

#7 lore raw
In reply to Aaron Lewis

Since iptables are kind of static I think a simple script should be good enough.

A one liner should do the trick:
tables="filter nat raw mangle";counter="0"; for i in $tables; do add=iptables -t $i -L -n --line-numbers |egrep "^[0-9]+\ " |wc -l; counter=expr $counter + $add;done ;echo $counter

You dont need to read the proc file system to know that there are only four tables exits in iptables.

Just remind me why do we need another tool on-top all the existing ones?
But I do seem to understand what you mean by that there is no option to just count the number of rules in a table. if you really want to to be used as a command just restrict the script to execution only..
This is why permissions do exist.

Best regards,
Eliezer

Quoted 36 lines · Aaron Lewis

Already checked the manual on my system ... there's no counting support, the only thing relevant was --line-numbers,

My code is here, for anyone who needed

https://raw.github.com/CaledoniaProject/ipt_counting/master/ipt-count.c

I just hope one day such feature would be included officially.

Quoted 22 lines · Eliezer Croitoru

Hey Aaron,

I feel kind of odd but this should answer you:
http://linux.die.net/man/8/iptables
www.garron.me/linux/iptables-manual.html

Eliezer

Quoted 11 lines · Aaron Lewis

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

Signature · 1 line
Eliezer
#8 lore raw
Quoted 10 lines · Eliezer Croitoru

Since iptables are kind of static I think a simple script should be good enough.

A one liner should do the trick:
tables="filter nat raw mangle";counter="0"; for i in $tables; do add=iptables -t $i -L -n --line-numbers |egrep "^[0-9]+\ " |wc -l; counter=expr $counter + $add;done ;echo $counter

You dont need to read the proc file system to know that there are only four tables exits in iptables.

That is not true.
There also is the security table.
And if you have xtables-addons installed, there might also be the rawpost table.
But any of those might not be loaded, if compiled in as loadable module.
So you might need to read /proc/net/ip_tables_names to work only on existing tables, without loading unwanted/needed ones.

[...]

#9 lore raw
Quoted 9 lines · Born Without

That is not true.
There also is the security table.
And if you have xtables-addons installed, there might also be the rawpost table.
But any of those might not be loaded, if compiled in as loadable module. So you might need to read /proc/net/ip_tables_names to work only on existing tables, without loading unwanted/needed ones.

[...]

You can read For these specific cases.
But still it's not changing the basic concept which you don't need a new binary to do all the above just add:
tables=cat /proc/net/ip_tables_names

He do have a point that adding this option he seeks is such a simple task and can be added into iptables as a simple --rules-count or any other directive.

I really don't know why and how this system works so if a binary works it's fine by me.

The distance between the Binary file and this script is portability and complexity.

Regards,
Eliezer

author
#10 lore raw
In reply to Aaron Lewis

Just FYI,

I'm not in a hurry .. for now I did a little tweak to the iptables program and accomplished this.

libiptc isn't in a stable state, right?

Quoted 14 lines · Aaron Lewis

Hi,
I want to know if I could get how many rules are present, i.e in filter table?

Now I do iptables -L | wc -l like stuff, I know it's not right, but iptables itself doesn't seem to count rules anyway.

I need this just to let user to know how many rules are present, without root privileges, and now being able to view actual rules.

--
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://pgp.mit.edu/ ) Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

Signature · 3 lines
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E