Le 31/03/2011 21:24, Jozsef Kadlecsik a écrit :
On Thu, 31 Mar 2011, Jean-Philippe Menil wrote:Let me explain, in iptables, i have this in a mangle chain: Chain WD_BG_Outgoing (1 references) pkts bytes target prot opt in out source destination 238K 18M MARK all -- * * 192.168.10.255 0.0.0.0/0 MAC F0:7B:CB:8C:6C:6F MARK set 0x2 196K 12M MARK all -- * * 192.168.11.214 0.0.0.0/0 MAC 00:25:00:4E:E3:B7 MARK set 0x2 9436 3210K MARK all -- * * 192.168.10.195 0.0.0.0/0 MAC F0:7B:CB:52:3D:BE MARK set 0x2 289K 68M MARK all -- * * 192.168.11.211 0.0.0.0/0 MAC 00:22:69:3D:4C:13 MARK set 0x2 710K 40M MARK all -- * * 192.168.10.34 0.0.0.0/0 MAC C8:0A:A9:45:E5:3D MARK set 0x2 1605K 93M MARK all -- * * 192.168.11.155 0.0.0.0/0 MAC 00:26:6C:5A:0C:0A MARK set 0x2 81534 14M MARK all -- * * 192.168.11.136 0.0.0.0/0 MAC 00:0F:B0:D6:1D:19 MARK set 0x2 420K 26M MARK all -- * * 192.168.11.149 0.0.0.0/0 MAC 00:24:21:44:FB:40 MARK set 0x2 13128 3437K MARK all -- * * 192.168.10.186 0.0.0.0/0 MAC 00:26:5E:27:8C:33 MARK set 0x2 --snip-- If i use ipset, with rules like these: ipset -N WEBAUTHIP bitmap:ip,mac --network 192.168.10.0/24 iptables -t mangle -I WD_BG_Outgoing -m set --set WEBAUTHIP src -j ACCEPT And add clients with ipset -A WEBAUTHIP ip,mac If i list my mangle chain (WD_BG_Outgoing), i will see only the counters for the WEBAUTHIP match-set, Chain WD_BG_Outgoing (0 references) pkts bytes target prot opt in out source destination 111M 475M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 match-set WEBAUTHIP src and i can't anymore check the counters by ip of my clientsThe rules are collapsed into a single rule, so there are no more individual counters. That's a tradeof and you have to decide which is more important: less rules or counters. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
That's what i tought, and i needed to be sure. As i can miss the counters for the moment, i will kept my rules. But as i'm very intereted by ipset, i will think to do otherwise. Thanks a lot. Regards. -- Jean-Philippe Menil - Pôle réseau Service IRTS DSI Université de Nantes jean-philippe.menil@xxxxxxxxxxxxxx Tel : 02.53.48.49.27 - Fax : 02.53.48.49.09 -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
