Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to be able to count the number of bytes going to a given MAC address using iptables or ebtables or some other linux utility. I have tried looking at the byte counts in ebtables but they are always 0, am I doing something wrong here?

share|improve this question

IPTables supports traffic accounting. You should just be able to setup an IPtables rule matching the mac address you are interested in, then look at it's counters to see what kind of traffic it's pushing. Note that you can't use this to look at traffic for other machines on the LAN, it will only be for traffic to or from the machine it's running on.

share|improve this answer
I'm running the machine as a firewall so it will have packets destined for other MAC addresses, but IPtables only has a source MAC address option, not a destination one. – DanielGibbs Nov 21 '11 at 23:56
Do you need this to be command line based? will do this all for you, and works very very nicely when run on a firewall. – devicenull Nov 22 '11 at 0:04
Unfortunately it does need to be command line based. – DanielGibbs Nov 22 '11 at 0:59
up vote 0 down vote accepted

I ended up solving this by getting the IP address associated with each MAC address from arp and adding an accounting rule in iptables to count download traffic for that IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.