Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Don’t understand [0:0] iptable syntax

My server is Red Hat Enterprise Linux Server release 5.

I'm not an expert in Linux iptables firewall. I've the following entries in iptables:

[root@myserver ~]# more /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Mon Sep 14 20:04:30 2009
:PREROUTING ACCEPT [10934:1556118]
:OUTPUT ACCEPT [111392:6686084]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 5050
-A OUTPUT -d -p tcp -m tcp --dport 80 -j DNAT --to-destination
-A OUTPUT -d -p tcp -m tcp --dport 80 -j DNAT --to-destination
# Completed on Mon Sep 14 20:04:30 2009

What does the value range in the bracket mean? For example, here: PREROUTING ACCEPT [10934:1556118], what does the range 10934:1556118 mean?

share|improve this question

marked as duplicate by Zoredache, Doug Luxem, Alex, mdpc, EEAA Jan 3 '13 at 3:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 4 down vote accepted

It is packet and byte counters, try this:

iptables -nvL OUTPUT


Address translation occurs before routing. Facilitates the transformation of the destination IP address to be compatible with the firewall's routing table. Used with NAT of the destination IP address, also known as destination NAT or DNAT.

share|improve this answer
Thanks for that information. On executing iptables -nvL OUTPUT, I'm getting pkts value as 7984K and bytes value as 2310M. But the values in /etc/sysconfig/iptables are showing the same values. Why this difference? – Gnanam Aug 4 '10 at 7:26
@Gnanam could you post the top line showing the packts information... – Prix Aug 4 '10 at 7:36
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 7984K 2310M ACCEPT all -- * * – Gnanam Aug 4 '10 at 7:55
try this for a simple test, iptables-save > /tmp/test.iptables then cat /tmp/test.iptables | grep "OUTPUT ACCEPT", those are just counters and you can even reset it with the option -Z if you want. iptables -Z; iptables -Z -t mangle; iptables -Z -t nat – Prix Aug 4 '10 at 8:02

They are the saved values of the byte and packet counters for the specified table's chain policy. In your case the nat table. Have a look here for more information on iptables-save.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.