A coded form of the options we use when invoking ipfwadm.
ifname
The name of the interface to which the rule applies.
ifaddress
The address of the interface to which the rule applies.
By default, ipfwadm displays the packet and byte counts in a shortened form, rounded to the nearest thousand (K) or million (M). We can ask it to display the collected data in exact units by using the expanded option as follows:
# ipfwadm -A -l -e -x
Listing Accounting Data with ipchains
The ipchains command will not display our accounting data (packet and byte counters) unless we supply it the -v argument. The simplest means of listing our accounting data with the ipchains is to use it like this:
# ipchains -L -v
Again, just as with ipfwadm, we can display the packet and byte counters in units by using the expanded output mode. The ipchains uses the -x argument for this:
# ipchains -L -v -x
Listing Accounting Data with iptables
The iptables command behaves very similarly to the ipchains command. Again, we must use the -v when listing tour rules to see the accounting counters. To list our accounting data, we would use:
# iptables -L -v
Just as for the ipchains command, you can use the -x argument to show the output in expanded format with unit figures.
Resetting the Counters
The IP accounting counters will overflow if you leave them long enough. If they overflow, you will have difficulty determining the value they actually represent. To avoid this problem, you should read the accounting data periodically, record it, and then reset the counters back to zero to begin collecting accounting information for the next accounting interval.
The ipfwadm and ipchains commands provide you with a means of doing this quite simply:
# ipfwadm -A -z
or:
# ipchains -Z
or:
# iptables -Z
You can even combine the list and zeroing actions together to ensure that no accounting data is lost in between:
# ipfwadm -A -l -z
or:
# ipchains -L -Z
or:
# iptables -L -Z -v
These commands will first list the accounting data and then immediately zero the counters and begin counting again. If you are interested in collecting and using this information regularly, you would probably want to put this command into a script that recorded the output and stored it somewhere, and execute the script periodically using the cron command.
Flushing the Ruleset
One last command that might be useful allows you to flush all the IP accounting rules you have configured. This is most useful when you want to radically alter your ruleset without rebooting the machine.
The -f argument in combination with the ipfwadm command will flush all of the rules of the type you specify. ipchains supports the -F argument, which does the same:
# ipfwadm -A -f
or:
# ipchains -F
or:
# iptables -F
This flushes all of your configured IP accounting rules, removing them all and saving you having to remove each of them individually. Note that flushing the rules with ipchains does not cause any user-defined chains to be removed, only the rules within them.
Passive Collection of Accounting Data
One last trick you might like to consider: if your Linux machine is connected to an Ethernet, you can apply accounting rules to all of the data from the segment, not only that which it is transmitted by or destined for it. Your machine will passively listen to all of the data on the segment and count it.
You should first turn IP forwarding off on your Linux machine so that it doesn't try to route the datagrams it receives.[65] In the 2.0.36 and 2.2 kernels, this is a matter of:
# echo 0 ›/proc/sys/net/ipv4/ip_forward
You should then enable promiscuous mode on your Ethernet interface using the ifconfig command. Now you can establish accounting rules that allow you to collect information about the datagrams flowing across your Ethernet without involving your Linux in the route at all.
Chapter 11. IP Masquerade and Network Address Translation
You don't have to have a good memory to remember a time when only large organizations could afford to have a number of computers networked together by a LAN. Today network technology has dropped so much in price that two things have happened. First, LANs are now commonplace, even in many household environments. Certainly many Linux users will have two or more computers connected by some Ethernet. Second, network
