Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I ran sudo iptables -L -v on 2013-01-25 and 2013-01-28. I get the following lines for the INPUT chain.

2013-01-25

774K  392M ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED 

2013-01-28

1060K  532M ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED

What data is being accepted by this rule and why might the byte count be so high on a server which should not be receiving much data?

UPDATE:

The server is set up as a Web server but the sites on the server are not popular. It is more of a test server. The traffic received is SSH and web based traffic on port 80.

These are all the rules on the INPUT chain

Chain INPUT (policy ACCEPT 620 packets, 103K bytes)
pkts bytes target     prot opt in     out     source               destination         
3423  282K ACCEPT     all  --  lo     any     anywhere             anywhere            
1065K  533M ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED 
44  2640 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh
2604  144K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www 
3103  208K LOG        all  --  any    any     anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
3249  230K DROP       all  --  any    any     anywhere             anywhere   
share|improve this question

1 Answer 1

up vote 3 down vote accepted

First, this can not be explained clearly because you are not showing the complete iptables rules and you are not describing the type of traffic you are sending/receiving. Also, this is not a high traffic on a server.

It is normal for the RELATED / ESTABLISHED rule to receive most of the traffic as the first packet hits some other rule and remaining traffic hits this rule.

share|improve this answer
    
So first the traffic will hit my SSH or WWW rules and then the rest of the traffic will hit the RELATED/ESTABLISHED rule because it is an existing connection? –  AJ Dhaliwal Jan 28 '13 at 16:15
    
@AJDhaliwal That is correct. –  Michael Hampton Jan 28 '13 at 19:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.