Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 124
  • Last Modified:

Iptables and mirroring ports

I am running iptables on Centos and want them to count all traffic on other device, so I have mirrored ports between the Centos and the device.
I can dump all traffic with tcpdump but the counters on iptables donĀ“t see anything.
But if I run the Centos as router iptables count every byte for me.

Is it poosible to use iptables counting in mirroring mode ?
0
soffcec
Asked:
soffcec
  • 2
3 Solutions
 
Duncan RoeSoftware DeveloperCommented:
I am not familiar with this mirroring mode of which you speak. Iptables will only count packets which match a rule: if the Centos system is not router then will this happen?
Could you elaborate on mirroring mode and also what are your iptables rules when Centos is not router?
0
 
soffcecAuthor Commented:
I put one line for each ip address for in and out and call them COUNT_IN and COUNT_OUT
-A COUNT_IN -d 185.152.116.9 -j ACCEPT
-A COUNT_OUT -s 185.152.116.9 -j ACCEPT

The result from Centos when I use it for routing is:
iptables -L -n -v
  300  142K ACCEPT     all  --  *      *       0.0.0.0/0            185.152.116.9
  258  950K ACCEPT     all  --  *      *       185.152.116.9   0.0.0.0/0  
 But when I run Centos as standalone and mirror my Hardwarerouter nothing counts.

How can I make iptables sniff the traffic on the hardware router ?
Or is there any other solution to count the usage of each ip address (have about 1000 addresses on my system)
0
 
Duncan RoeSoftware DeveloperCommented:
iptables is  certainly not a sniffer. Unless the packet is destined for the box or to be routed through it, it will not get counted.
For what you want to do, I suggest some combination of tcpdump and awk.
0
 
Dan CraciunIT ConsultantCommented:
I would use ntop/ntopng for that.

HTH,
Dan
0

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now