sorting and saving usage data collected by iptables

Question

I use iptables based MAC access restriction. I have listed MAC id's of users whom I want to allow access, and drop rest. And when I run iptables -vL it shows all MAC id's and their usage: packets transferred, data in bytesh. So my questions are:

1. Is it possible to make it show data usage in mega bytes?
2. Can I sort it so that the MAC id's of heavy users will come at top?
3. And, finally, can I save the data to disk, may be into a database, so that it can add up and survive reboots?

Answer 1

Answer #1

What's your iptables --version?

On mine, iptables -vL automatically converts the bytes into Kbytes (K suffix) or Mbytes (M suffix).

Answer #2

Use iptables -x piped to sort, e.g. iptables -xvL $CHAIN | sort -rn -k 2

Answer #3

Pipe the output of the above commands to a script which will do the database insert.

You may want to further filter the output of Answer #2 using awk '$1 ~ /[0-9]+/' to remove the column headings, and awk '$1 > 1000000' to see only those values larger than 1'000'000 bytes.

---

Process output into CSV format

iptables -xvnL $CHAIN | awk -v min=$MINIMUM '$1 ~ /[0-9]+/ && $2 >= min {print $2 "," $11}'

Or, if you need the CSV column heading:

iptables -xvnL $CHAIN | awk -v min=$MINIMUM 'BEGIN {print "Bytes,MAC"} $1 ~ /[0-9]+/ && $2 >= min {print $2 "," $11}'

Answer 2

AWK is your friend. http://en.wikipedia.org/wiki/AWK