Iptables and mirroring ports

I am running iptables on Centos and want them to count all traffic on other device, so I have mirrored ports between the Centos and the device.
I can dump all traffic with tcpdump but the counters on iptables don´t see anything.
But if I run the Centos as router iptables count every byte for me.

Is it poosible to use iptables counting in mirroring mode ?
Who is Participating?
Dan CraciunIT ConsultantCommented:
I would use ntop/ntopng for that.

Duncan RoeSoftware DeveloperCommented:
I am not familiar with this mirroring mode of which you speak. Iptables will only count packets which match a rule: if the Centos system is not router then will this happen?
Could you elaborate on mirroring mode and also what are your iptables rules when Centos is not router?
soffcecManagerAuthor Commented:
I put one line for each ip address for in and out and call them COUNT_IN and COUNT_OUT

The result from Centos when I use it for routing is:
iptables -L -n -v
  300  142K ACCEPT     all  --  *      *  
  258  950K ACCEPT     all  --  *      *  
 But when I run Centos as standalone and mirror my Hardwarerouter nothing counts.

How can I make iptables sniff the traffic on the hardware router ?
Or is there any other solution to count the usage of each ip address (have about 1000 addresses on my system)
Duncan RoeSoftware DeveloperCommented:
iptables is  certainly not a sniffer. Unless the packet is destined for the box or to be routed through it, it will not get counted.
For what you want to do, I suggest some combination of tcpdump and awk.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.