This is a great idea, thank you! This is a problem I'm trying to
solve right now and have found that using the rule counters is clunky
and restrictive. Specifically, this provides the kind of
functionality that's needed to support changing the rule definitions
without losing the accounting information.
Quick question, would this be limited to the filter table, or would we
be able to use the target (or match as I saw suggested) in other
tables?
This would be most useful if it were available in the mangle (so we
could mark+account in one spot... and if it were a match, in one rule)
and nat tables (so we can account for traffic pre and post NAT
treatment).
- Pete
On Wed, Dec 14, 2011 at 3:00 AM, <pablo@xxxxxxxxxxxxx> wrote:
> From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
>
> Hi!
>
> We currently have two ways to account traffic in netfilter:
>
> - iptables chain and rule counters:
>
> # iptables -L -n -v
> Chain INPUT (policy DROP 3 packets, 867 bytes)
> pkts bytes target prot opt in out source destinat
> 8 1104 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/
>
> - use flow-based accounting provided by ctnetlink:
>
> # conntrack -L
> tcp 6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58
>
> While trying to display real-time accounting statistics, we require
> to pool the kernel periodically to obtain this information. This is
> OK if the number of flows is relatively low. However, in case that
> the number of flows is huge, we can spend a considerable amount of
> cycles to iterate over the list of flows that have been obtained.
>
> Moreover, if we want to obtain the sum of the flow accounting results
> that match some criteria, we have to iterate over the whole list of
> existing flows, look for matchings and update the counters.
>
> This patchset adds the extended accounting infrastructure in
> kernel-space. It is composed of one nfnetlink interface that
> allows you to create, to update and to retrieve accounting objects.
> These objects can be used to account traffic with the flexibility
> that iptables rules provide (by means of the new NFACCT target).
>
> Quick example of use:
>
> 1) You create the accounting object:
>
> libnetfilter_acct/examples# ./nfacct-add http-traffic
>
> 2) Add the iptables rules for traffic you want to account:
>
> # iptables -I INPUT -p tcp --sport 80 -j NFACCT --nfacct-name http-traffic
> # iptables -I OUTPUT -p tcp --dport 80 -j NFACCT --nfacct-name http-traffic
>
> 3) Retrieve the counters.
>
> libnetfilter_acct/examples# ./nfacct-get
> http-traffic = { pkts = 000000000125, bytes = 000000023162 };
>
> You can also atomically retrieve and zero counters in case that you
> want to collect information periodically.
>
> This comes with the user-space libnetfilter_acct library:
>
> http://1984.lsi.us.es/git/libnetfilter_acct/
>
> [Note: The current library API is still quite preliminary. I plan
> to heavily rework it]
>
> And the NFACCT extension for user-space iptables is here:
>
> http://1984.lsi.us.es/git/iptables/commit/?id=850104ff9d619a7e0bc561aa16fee838fcd1937c
>
> Comments welcome!
>
> Pablo Neira Ayuso (2):
> netfilter: add extended accounting infrastructure over nfnetlink
> netfilter: xtables: add NFACCT target to support extended accounting
>
> include/linux/netfilter/Kbuild | 2 +
> include/linux/netfilter/nfnetlink.h | 3 +-
> include/linux/netfilter/nfnetlink_acct.h | 34 +++
> include/linux/netfilter/xt_NFACCT.h | 17 ++
> net/netfilter/Kconfig | 18 ++
> net/netfilter/Makefile | 2 +
> net/netfilter/nfnetlink_acct.c | 352 ++++++++++++++++++++++++++++++
> net/netfilter/xt_NFACCT.c | 78 +++++++
> 8 files changed, 505 insertions(+), 1 deletions(-)
> create mode 100644 include/linux/netfilter/nfnetlink_acct.h
> create mode 100644 include/linux/netfilter/xt_NFACCT.h
> create mode 100644 net/netfilter/nfnetlink_acct.c
> create mode 100644 net/netfilter/xt_NFACCT.c
>
> --
> 1.7.2.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
