Packets Counting
I do not have time this instant to share the code but the outline of a packet counter I use is to create chain MANGLE_ACTIVITY in -t mangle, add a rule that simply RETURNs to MANGLE_ACTIVITY, Insert a jump to the MANGLE_ACTIVITY chain in -t mangle PREROUTING (so it is the first chain hit by all incoming packets), use whatever matches, like --sport or --dport (remember to specify protocol with port matches) and/or an interface match. Then, in a script (mine happens to be Perl), run "iptables -t mangle -nvL MANGLE_ACTIVITY" and pipe (|) it through grep to get the RETURN line with the packet count and pipe it through awk to pick off the packet count followed by
"iptables -t mangle -Z MANGLE_ACTIVITY" to zero the counter, both in a loop with a sleep to get the interval (approximately).
Hope this helps.
Bill
(Without deadlines, we'd live forever.)
Quoted 33 lines · M. A. Imam
Can i record the the number of packets each 2 seconds with tcpdump. i can see packets with tcpdump but how to count it every 2 seconds
Quoted 26 lines
===== Original Message From [email protected] =====
Maybe you should use tcpdump for testing purposes instead of using iptables.Just my opinion.
Regards,
Edvin
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of M. A. Imam
Sent: Mittwoch, 16. März 2005 16:56
To: [email protected]
Subject: Packets CountingHi,
How can i count the number of packets on an interface evry 2 or 5 seconds. and
i want to count only specific packets like only arriving packets from port 5001Any ideas...
Muhammad
Signature · 4 lines
William Chappell, Software Engineer, Critical Technologies Inc. * Creativity * Diversity * Expertise * Flexibility * Integrity * Suite 400 Technology Center, 4th Floor 1001 Broad St, Utica NY 13501 315-793-0248 x148 FAX -9710 <[email protected]> www.critical.com
Heh, no fair! That's more clever than the one I did off the cuff :)
Quoted 59 lines · Bill Chappell
I do not have time this instant to share the code but the outline of a packet counter I use is to create chain
MANGLE_ACTIVITYin -t mangle, add a rule that simply RETURNs toMANGLE_ACTIVITY, Insert a jump to theMANGLE_ACTIVITYchain in -t mangle PREROUTING (so it is the first chain hit by all incoming packets), use whatever matches, like --sport or --dport (remember to specify protocol with port matches) and/or an interface match. Then, in a script (mine happens to be Perl), run "iptables -t mangle -nvLMANGLE_ACTIVITY" and pipe (|) it through grep to get the RETURN line with the packet count and pipe it through awk to pick off the packet count followed by
"iptables -t mangle -ZMANGLE_ACTIVITY" to zero the counter, both in a loop with a sleep to get the interval (approximately).Hope this helps.
Bill
(Without deadlines, we'd live forever.)
Quoted 34 lines · M. A. Imam
Can i record the the number of packets each 2 seconds with tcpdump. i can see packets with tcpdump but how to count it every 2 seconds
Quoted 26 lines
===== Original Message From [email protected] =====
Maybe you should use tcpdump for testing purposes instead of using iptables.Just my opinion.
Regards,
Edvin
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of M. A. Imam
Sent: Mittwoch, 16. März 2005 16:56
To: [email protected]
Subject: Packets CountingHi,
How can i count the number of packets on an interface evry 2 or 5 seconds. and
i want to count only specific packets like only arriving packets from port 5001Any ideas...
Muhammad
Quoted 13 lines · Bill Chappell
I do not have time this instant to share the code but the outline of a packet counter I use is to create chain
MANGLE_ACTIVITYin -t mangle, add a rule that simply RETURNs toMANGLE_ACTIVITY, Insert a jump to theMANGLE_ACTIVITYchain in -t mangle PREROUTING (so it is the first chain hit by all incoming packets), use whatever matches, like --sport or --dport (remember to specify protocol with port matches) and/or an interface match. Then, in a script (mine happens to be Perl), run "iptables -t mangle -nvLMANGLE_ACTIVITY" and pipe (|) it through grep to get the RETURN line with the packet count and pipe it through awk to pick off the packet count followed by
"iptables -t mangle -ZMANGLE_ACTIVITY" to zero the counter, both in a loop with a sleep to get the interval (approximately).
Quoted 5 lines
Hope this helps.
Bill
(Without deadlines, we'd live forever.)
If you have a lot of rules you have to watch the counters it's better to do a little daemon that read the counters using libiptc, because using bash or perl to read them it's too slow.
We have a daemon that do this called bastion-firewall-stats in our bastion-firewall GPL firewall. Anyone interested can download the source in our web site: http://www.bgsec.com/downloads.html
Regards.
Signature · 12 lines
Jose Maria Lopez Hernandez Director Tecnico de bgSEC [email protected] bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road"