Skip to contentSkip to conversation

bandwidth again maybe O T

DISCUSSION PayalR 3 participants 4 messages Sep 5, 2002 3 messages not in the archive

lore
Share & tools
lore

PayalR

author
#2 lore raw
In reply to a message not in the archive

Hi,
Thanks a lot for mails. Well, I think I get the general idea.

Quoted 4 lines

However, to measure the amount of http traffic going to/from a specific IP address, put a couple of rules such as this in your FORWARD chain:
iptables -I FORWARD -d a.b.c.d -p tcp --dport 80
iptables -I FORWARD -s a.b.c.d -p tcp --sport 80

I wanted for all protocol and not just http so I modified your rule a bit like,
iptables -I FORWARD -d 192.168.0.1 -p tcp
iptables -I FORWARD -s 192.168.0.1 -p tcp

These are the only two rules I have.

I tried to test it using
#iptables -L FORWARD -x -v
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 tcp -- any any localhost.localdomain
anywhere

0 0 tcp -- any any anywhere
localhost.localdomain

I tried pinging it few times, connecting to port 25, telnet, 80 etc. fom the local machine. But the number of bytes above do not change.
What must be wrong?
Thanks a lot in advance and bye.
-Payal

Quoted 14 lines

You might want to run this command in a cron job every day (or perhaps more frequently) and then you can calculate daily traffic patterns throughout a month etc.

You can reset the counters with

iptables -Z FORWARD

If you combine the -Z option with the earlier command, you will find out the values of the counters and then they will be (atomically) reset to zero so you can start counting a new day from zero.

Antony.

#4 lore raw
In reply to a message not in the archive
Quoted 24 lines · PayalR

Hi,
Thanks a lot for mails. Well, I think I get the general idea.

Quoted 6 lines

However, to measure the amount of http traffic going to/from a specific IP address, put a couple of rules such as this in your FORWARD chain:
iptables -I FORWARD -d a.b.c.d -p tcp --dport 80
iptables -I FORWARD -s a.b.c.d -p tcp --sport 80

I wanted for all protocol and not just http so I modified your rule a bit like, iptables -I FORWARD -d 192.168.0.1 -p tcp
iptables -I FORWARD -s 192.168.0.1 -p tcp

These are the only two rules I have.

I tried to test it using #iptables -L FORWARD -x -v Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 tcp -- any any localhost.localdomain
anywhere

Quoted 6 lines

0 0 tcp -- any any anywhere
localhost.localdomain

I tried pinging it few times, connecting to port 25, telnet, 80 etc. fom the local machine. But the number of bytes above do not change. What must be wrong?

Since you are pinging from localhost, I don't think the FORWARD chain is traversed. The packets go straight to OUTPUT chain. If the packets came from somewhere else, and are to be forwarded by the host on which iptabls is running, then the packets will be seen and counted by FORWARD.

Place the rules in the OUTPUT chain, you should see things from localhost being counted..

Cheers,
Michael

#6 lore raw
In reply to Michael
Quoted 6 lines · Michael

Ohh toss....

My appologies, I shall clarify:

If a packet originates from local processes, and is destined for a local process, the INPUT chain is traversed only.

That's not *quite* right - a packet from a local process to a local process traverses both the OUTPUT and INPUT chains (in that order).

Antony

Signature · 3 lines
Documentation is like sex:
when it's good, it's very very good;
when it's bad, it's still better than nothing.
#5 lore raw
In reply to Michael

Ohh toss....

My appologies, I shall clarify:

If a packet originates from local processes, and is destined for a local process, the INPUT chain is traversed only.

If a packet originates from local process and is destined for non local process, the OUTPUT chain is traversed only.

If the packet originates from non local process, and is destined for local process, the INPUT chain is traversed.

If packet originates non-local, and is destined non-local, it traverses FORWARD

For all, not considering any NAT or MASQ...

Sorry for any confusion I might have caused.

Quoted 6 lines · Michael

PayalR wrote:
<snip>

Since you are pinging from localhost, I don't think the FORWARD chain is traversed. The packets go straight to OUTPUT chain. If the packets came from somewhere else, and are to be forwarded by the host on which iptabls is running, then the packets will be seen and counted by FORWARD.

Place the rules in the OUTPUT chain, you should see things from localhost being counted..

Err so long as the destination is non-local...Otherwise it will be seen in INPUT chain...

Cheers,
Michael