soffcec
asked on
Iptables and mirroring ports
I am running iptables on Centos and want them to count all traffic on other device, so I have mirrored ports between the Centos and the device.
I can dump all traffic with tcpdump but the counters on iptables don´t see anything.
But if I run the Centos as router iptables count every byte for me.
Is it poosible to use iptables counting in mirroring mode ?
I can dump all traffic with tcpdump but the counters on iptables don´t see anything.
But if I run the Centos as router iptables count every byte for me.
Is it poosible to use iptables counting in mirroring mode ?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
-A COUNT_IN -d 185.152.116.9 -j ACCEPT
-A COUNT_OUT -s 185.152.116.9 -j ACCEPT
The result from Centos when I use it for routing is:
iptables -L -n -v
300 142K ACCEPT all -- * * 0.0.0.0/0 185.152.116.9
258 950K ACCEPT all -- * * 185.152.116.9 0.0.0.0/0
But when I run Centos as standalone and mirror my Hardwarerouter nothing counts.
How can I make iptables sniff the traffic on the hardware router ?
Or is there any other solution to count the usage of each ip address (have about 1000 addresses on my system)