Link to home
Start Free TrialLog in
Avatar of soffcec
soffcecFlag for Iceland

asked on

Iptables and mirroring ports

I am running iptables on Centos and want them to count all traffic on other device, so I have mirrored ports between the Centos and the device.
I can dump all traffic with tcpdump but the counters on iptables don´t see anything.
But if I run the Centos as router iptables count every byte for me.

Is it poosible to use iptables counting in mirroring mode ?
SOLUTION
Avatar of Duncan Roe
Duncan Roe
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of soffcec

ASKER

I put one line for each ip address for in and out and call them COUNT_IN and COUNT_OUT
-A COUNT_IN -d 185.152.116.9 -j ACCEPT
-A COUNT_OUT -s 185.152.116.9 -j ACCEPT

The result from Centos when I use it for routing is:
iptables -L -n -v
  300  142K ACCEPT     all  --  *      *       0.0.0.0/0            185.152.116.9
  258  950K ACCEPT     all  --  *      *       185.152.116.9   0.0.0.0/0  
 But when I run Centos as standalone and mirror my Hardwarerouter nothing counts.

How can I make iptables sniff the traffic on the hardware router ?
Or is there any other solution to count the usage of each ip address (have about 1000 addresses on my system)
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial