2

This question already has an answer here:

If you don't give iptables a target, it simply counts how many bytes and packets match the rule. I'd like to count all packets that come from outside, i.e. don't match 10.0.0.0/8 and don't match 192.168.0.0/16.

My first intuition is:

iptables -A INPUT ! -s 10.0.0.0/8,192.168.0.0/16

However this adds two rules, of which each count separately, and no count of outside packets is discernible. So how do I count outside packets?

marked as duplicate by peterh, Community May 27 '15 at 22:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

I would be tempted to do something like this by creating a chain. Then adding rules to the chain to return the stuff you don't want. The stuff that lasts to the final rule of the chain will be the stuff you do want.

# untested
# create a new input counter chain
/sbin/iptables -t filter -N inputcounter
# redirect all traffic to chain
/sbin/iptables -t filter -A INPUT -j inputcounter
# return stuff we don't want to count
/sbin/iptables -t filter -A inputcounter -s 10.0.0.0/8 -j RETURN
/sbin/iptables -t filter -A inputcounter -s 192.168.0.0/16 -j RETURN
# Final rule will return everything else.  This should be a count of 
# everything that wasn't not previously excluded
/sbin/iptables -t filter -A inputcounter -j RETURN

Not the answer you're looking for? Browse other questions tagged or ask your own question.