On 10/08/2016 14:34, Pablo Neira Ayuso wrote:
On Wed, Aug 03, 2016 at 04:06:09PM +0200, jalvarez wrote:
Hi,
I am currently trying to add quotas for traffic that matches some nftables
rules.
While looking for a solution I have found the netfiler accounting
infrastructure (nfacct) very interesting.
Problem is I didn't find anything about nfacct in the nftables code.
Is there any nftables support (or planned support) for nfacct ?
I have a patchset that I need to spin over again, but it's coming with
native support for nftables.
Ok ! Are you refering to Ana Rey Botello's patchset ?
http://www.spinics.net/lists/netfilter-devel/msg34766.html
I looked very promising ! :)
In the end, do you think the following features could be added in nftables ?
- an expression to increment nfacct counters (maybe reusing the existing
semantic "counter xxx").
- an expression to match if the quota set on the nfacct object is
exceeded. Something like : "counter name xxx overquota".
This could lead to interesting things like starting to drop packets when
a quota is exceeded.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
