Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I came across this tutorial here that describes how to monitor bandwidth using iptables. I wanted to adapt it for a non-router machine, so I want to know how much data is going in/coming out and not passing through.

Here are the rules I added:

iptables -N ETH0_IN
iptables -N ETH0_OUT
iptables -I INPUT -i eth0 -j ETH0_IN
iptables -I OUTPUT -o eth0 -j ETH0_OUT

And here is a sample of the output:

user@host:/tmp$ sudo iptables -x -vL -n
Chain INPUT (policy ACCEPT 1549 packets, 225723 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
     199    54168 ETH0_IN    all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1417 packets, 178128 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
     201    19597 ETH0_OUT   all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           

Chain ETH0_IN (1 references)
    pkts      bytes target     prot opt in     out     source               destination         

Chain ETH0_OUT (1 references)
    pkts      bytes target     prot opt in     out     source               destination         

As seen above, there are no packet and byte values for ETH0_IN and ETH0_OUT, which is not the same result in the tutorial I referenced.

Is there a mistake that I made somewhere? Thanks for your time.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Create a term that matches all traffic and does nothing (but count):

iptables -A ETH0_IN
iptables -A ETH0_OUT

In your tutorial your custom chains contain similar entries - for whatever type of accounting you like. (per IP, per protocol...)


If you just want to account input/output traffic and do not do forwarding (what I read from "non-router machine"), get interface counters:

# ifconfig eth0 | grep 'RX bytes'
      RX bytes:7029377146 (7.0 GB)  TX bytes:923972351 (923.9 MB)


If you are doing just a total you can even save the custom chains and do

iptables -A INPUT  -i eth0
iptables -A OUTPUT -o eth0

to get your counters....

share|improve this answer
    
I see, thanks. Regarding interface counters, I can't use them since the machine's 32 bit, so it will overflow. –  user1591276 Sep 6 '12 at 15:16
    
As long as you are reading counters often enough that in-between less than 4 gig are transferred, you can detect an overflow and calculate around it. ;-) –  Michuelnik Sep 6 '12 at 15:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.