[SOLVED] iptables chain's bytes counting problem

Question

Can somebody explain me what is wrong? I've got this code:
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -X
iptables -N traffic-output
iptables -F traffic-output
iptables -N all-traffic
iptables -F all-traffic
iptables -N ssh-traffic
iptables -F ssh-traffic
iptables -N www-traffic
iptables -F www-traffic
iptables -N smb139-traffic
iptables -F smb139-traffic
iptables -N smb445-traffic
iptables -F smb445-traffic
iptables -A INPUT -j all-traffic
iptables -A OUTPUT -j all-traffic
iptables -A all-traffic -j traffic-output
iptables -A INPUT -p tcp --dport 22 -j ssh-traffic
iptables -A OUTPUT -p tcp --sport 22 -j ssh-traffic
iptables -A ssh-traffic -j traffic-output
iptables -A INPUT -p tcp --dport 80 -j www-traffic
iptables -A OUTPUT -p tcp --sport 80 -j www-traffic
iptables -A www-traffic -j traffic-output
iptables -A INPUT -p tcp --dport 139 -j smb139-traffic
iptables -A OUTPUT -p tcp --sport 139 -j smb139-traffic
iptables -A smb139-traffic -j traffic-output
iptables -A INPUT -p tcp --dport 445 -j smb445-traffic
iptables -A OUTPUT -p tcp --sport 445 -j smb445-traffic
iptables -A smb445-traffic -j traffic-output
On Debian with iptables 1.4.14 that code works - that means every chain counts data
On Arch with iptables 1.4.19.1 - doesnt work. Only chain "all-traffic" is counted
On Centos with iptables 1.4.7 the same problem as in Arch
Last edited by koralgolek (2013-09-03 09:57:47)

Answer 1

I dont know how does exactly this work but "traffic-output" is assistant I think. Without it I can't count traffic by
ALL=`${GREP_BIN} -A 2 "Chain all-traffic" ${LOGPATH}/tmpfile | ${TAIL_BIN} -n 1 | ${AWK_BIN} '{print $2}'`
echo -n "$ALL" > ${LOGPATH}/all-traffic
Chain INPUT (policy ACCEPT 22667586 packets, 14171167058 bytes)
pkts bytes target prot opt in out source destination
22667586 14171167058 all-traffic all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ssh-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22
6708132 6335579351 www-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80
0 0 ftp-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20
207290 184172880 radio-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:8000
0 0 gre-traffic 47 -- * * 0.0.0.0/0 0.0.0.0/0
861845 127458416 udp-traffic udp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 9952226 packets, 1190096720 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 25693737 packets, 16639842951 bytes)
pkts bytes target prot opt in out source destination
0 0 ssh-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
5755417 903418420 www-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ftp-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
201706 10553522 radio-traffic tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
0 0 gre-traffic 47 -- * * 0.0.0.0/0 0.0.0.0/0
488561 34544719 udp-traffic udp -- * * 0.0.0.0/0 0.0.0.0/0
Chain all-traffic (1 references)
pkts bytes target prot opt in out source destination
22667586 14171167058 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ftp-traffic (2 references)
pkts bytes target prot opt in out source destination
0 0 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain gre-traffic (2 references)
pkts bytes target prot opt in out source destination
0 0 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain radio-traffic (2 references)
pkts bytes target prot opt in out source destination
408996 194726402 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ssh-traffic (2 references)
pkts bytes target prot opt in out source destination
0 0 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain traffic-output (7 references)
pkts bytes target prot opt in out source destination
Chain udp-traffic (2 references)
pkts bytes target prot opt in out source destination
1350406 162003135 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain www-traffic (2 references)
pkts bytes target prot opt in out source destination
12463549 7238997771 traffic-output all -- * * 0.0.0.0/0 0.0.0.0/0
When I remove traffic-output then every chain at the bottom looks like the traffic-output in example above (there is empty line, without even 0)