How to read packet counter of a single item?
Hi,
1) Which libipset function can be used for getting the packet counter value of a single entry in the set/list?
Using the function ipset_parse_line(ips, line) I can issue most of the ipset functions, but I need also a method
for getting the packet counter for just a single item only, ie. not the output of all items as "ipset save" does.
I need to do this in C/C++ (hence libipset in Linux), ie. not in script.
2) man ipset says
"test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
Test whether an entry is in a set or not. Exit status number is zero if
the tested entry is in the set and nonzero if it is missing from the set."
But the TEST-OPTIONS are not further described or documented. What test options are possible?
Hi,
Quoted 8 lines · U.Mutlu
1) Which libipset function can be used for getting the packet counter value of a single entry in the set/list?
Using the function
ipset_parse_line(ips, line)I can issue most of the ipset functions, but I need also a method for getting the packet counter for just a single item only, ie. not the output of all items as "ipset save" does. I need to do this in C/C++ (hence libipset in Linux), ie. not in script.
There is no such functionality in ipset. You can test the existence of an element in a set or list/save all of them with all of the attached attributes.
Quoted 7 lines
2) man ipset says
"test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
Test whether an entry is in a set or not. Exit status number is zero if the
tested entry is in the set and nonzero if it is missing from the set."But the TEST-OPTIONS are not further described or documented. What test options are possible?
There's a single one in the case of list:set: to test the element before or after a reference one.
Best regards,
Jozsef
Signature · 4 lines
E-mail : [email protected], [email protected] PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary
Jozsef Kadlecsik wrote on 10/13/23 21:05:
Quoted 11 lines · U.Mutlu
Quoted 9 lines
1) Which libipset function can be used for getting the packet counter value of a single entry in the set/list?
Using the function
ipset_parse_line(ips, line)I can issue most of the ipset functions, but I need also a method for getting the packet counter for just a single item only, ie. not the output of all items as "ipset save" does. I need to do this in C/C++ (hence libipset in Linux), ie. not in script.
Quoted 3 lines
There is no such functionality in ipset. You can test the existence of an element in a set or list/save all of them with all of the attached attributes.
I guess you mean just the ipset command line tool, whereas I explicitly stated libipset.
After researching it further I think it should be possible to read the counter of a single item via libipset & co.,
or at least testing the item for having a counter value "gt" etc, as is already possible in the iptables extensions, ie. "-m set --packets-gt value" etc.
Quoted 10 lines
Quoted 7 lines
2) man ipset says
"test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
Test whether an entry is in a set or not. Exit status number is zero if the
tested entry is in the set and nonzero if it is missing from the set."But the TEST-OPTIONS are not further described or documented. What test options are possible?
There's a single one in the case of list:set: to test the element before or after a reference one.
Can you give a practical example for this?
Quoted 12 lines · U.Mutlu
Jozsef Kadlecsik wrote on 10/13/23 21:05:
Quoted 11 lines · U.Mutlu
Quoted 9 lines
1) Which libipset function can be used for getting the packet counter value of a single entry in the set/list?
Using the function
ipset_parse_line(ips, line)I can issue most of the ipset functions, but I need also a method for getting the packet counter for just a single item only, ie. not the output of all items as "ipset save" does. I need to do this in C/C++ (hence libipset in Linux), ie. not in script.
Quoted 6 lines
Quoted 3 lines
There is no such functionality in ipset. You can test the existence of an element in a set or list/save all of them with all of the attached attributes.
I guess you mean just the ipset command line tool, whereas I explicitly stated libipset.
No, the functionality is missing both from the kernel and the user parts. Have a look at the ip_set_utest() function in the kernel which answers the test requests: just an error/success code is returned to userspace and nothing else. While the dump function (for save/restore) works for whole sets only. There is no "get_element" like functionality.
Quoted 4 lines
After researching it further I think it should be possible to read the counter of a single item via libipset & co., or at least testing the item for having a counter value "gt" etc, as is already possible in the iptables extensions, ie. "-m set --packets-gt value" etc.
That is for the kernel match functions to find matching elements in the sets with given criteria.
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
2) man ipset says
"test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
Test whether an entry is in a set or not. Exit status number is zero
if the
tested entry is in the set and nonzero if it is missing from the set."
Quoted 7 lines
Quoted 5 lines
Quoted 2 lines
But the TEST-OPTIONS are not further described or documented. What test options are possible?
There's a single one in the case of list:set: to test the element before or after a reference one.
Can you give a practical example for this?
I can give you an example but I don't think it's practical.
# Create a few sets
ipset n hosts hash:ip
ipset n nets hash:net
ipset n hostswithports hash:ip,port
ipset n netswithports hash:net,port
# "Aggregate" them in one single set so that you can refer them
# in a singe ip[6]tables rule ipset n access list:set ipset a access netswithports ipset a access hostswithports ipset a access nets ipset a access hosts
# If you want to make sure the order is right in the "access" set
# ... but listing is more straightforward ipset t access nets before hosts # returns ture ipset t access nets before hostswithports # returns false
Best regards,
Jozsef
Signature · 4 lines
E-mail : [email protected], [email protected] PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary