Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I inserted a rule to iptables to track the input usage to a certain ip address. The vps server's IP is 192.168.1.5 and the guest os's IP is 192.168.1.115. I ran 'yum update' inside the guest OS to get some network traffic. Then I ran iptables -vnL from the hypervisor. However it only showed network usage to the host, but not to the guest.

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

pkts    bytes        target               source               destination         
    0     0         0.0.0.0/0            0.0.0.0/0      destination IP range 192.168.1.115-192.168.1.115 

 1853  114K         0.0.0.0/0            0.0.0.0/0      destination IP range 192.168.1.5-192.168.1.5 

I ran tcpdump and the log showed that there're data packets to the guest os.

16:17:43.932514 IP mirrordenver.fdcservers.net.http > 192.168.1.115.34471: Flags [.], seq 17694667:17696115, ack 1345, win 113, options [nop,nop,TS val 1060308643 ecr 1958781], length 1448
16:17:43.932559 IP 192.168.1.115.34471 > mirrordenver.fdcservers.net.http: Flags [.], ack 17696115, win 15287, options [nop,nop,TS val 1958869 ecr 1060308643], length 0

Why the guest OS network usage couldn't be tracked?

iptables -L will return the INPUT chain as following:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
           all  --  anywhere             anywhere            destination IP range 192.168.1.115-192.168.1.115
           all  --  anywhere             anywhere            destination IP range 192.168.1.5-192.168.1.5    
           all  --  anywhere             anywhere    


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           destination IP range 192.168.1.1-192.168.1.249 
share|improve this question
    
I am not sure about the correct answer but according to my thinking it did not track it because the guest's ip may be dynamic or you may have some problem with the rule you inserted. Could you elaborate your rule? –  WiKi Jun 29 '13 at 1:18
    
the guest's ip is static –  Purres Jun 29 '13 at 1:26
    
yes, I updated the iptables –  Purres Jun 29 '13 at 1:32
    
I wonder why you're using IP ranges for a single destination IP. Just specify -d 192.0.2.111 or whatever. –  Falcon Momot Jun 29 '13 at 7:28

1 Answer 1

You don't say how you're arranging for traffic to get from the VPS server's physical NIC to the VPS's virtual NIC, but it's likely that this is a routed transaction. If this is so, then traffic to the VPS won't appear on the VPS server's INPUT chain, but on the FORWARD chain instead.

share|improve this answer
    
I updated the post with forward chain info. It had zero packets. –  Purres Jul 1 '13 at 17:07
    
So noted, but you still tell us nothing about how the networking is set up on the hypervisor. –  MadHatter Jul 1 '13 at 17:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.