Meaning of number inside iptable rules' brackets? [duplicate]

Question

Possible Duplicate:
Don’t understand [0:0] iptable syntax

E.g. The command iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080, lead to the configs

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [1:132]
:OUTPUT ACCEPT [1:132]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
COMMIT

Can anyone explain the line from

:PREROUTING ACCEPT [0:0]

to

:OUTPUT ACCEPT [1:132]

Especially what is the meaning of number inside iptable rules' brackets?

Answer 1

They are counters.. overall counters in fact.

Try this:

iptables -L INPUT

iptables -nvxL INPUT

iptables -nvxL

iptables -t nat -nvxL

iptables --line-numbers -nvxL

Now add this simple no-action rule:

iptables -A OUTPUT -p tcp -m tcp --dport 80

but without jump action, this is only a counter:

iptables --line-numbers -nvxL OUTPUT

You could make simple counter for mesuring everything you want:

iptables -A OUTPUT -p icmp -d 8.8.8.8

for counting packet using PING protocol routed to 8.8.8.8 (google-public-dns-a.google.com)

iptables -A INPUT -i eth0

for counting packet incomming from interface eth0.

More complex goals could use marked packets to sumarize more complex ideas (watching for encaplulated protocols, tracking for network location of an attacker, methods, etc...).

Using many counters is not harmfull for packet traversing, but the more rule are to check, the more time this may implie.

Read carefully iptables man page!