Marc wrote: > > Hi there, > I have quite a large list of blacklisted networks in my iptables > firewall, approx. 20,000. > Now I have a script that updates this blacklist according to my needs > every hour. My problem now is that during the update period (which > consists of several iptables [-I|-D] $CHAIN -s ... -j ... commands) my > traffic accounting is going haywire. > I have narrowed it down to the problem that displaying the rules (from > which I extract the traffic information via iptables -xvnL $CHAIN) > intermittently shows 0s (zeroes) as paket and byte counters while the > insert/delete commands are being issued. > Is there a locking problem? Should I maybe report this to the devel list? Have you considered using netfilter's ip sets for this? Sounds like it might be perfect for your needs. http://www.netfilter.org/projects/ipset/ -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
