Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

How can I list the number of connections per client on the FORWARD chain of an OpenWRT router?

I know how to list the number of connections per IP address on the router:

netstat -ntu | tail -n +3 |       # list open TCP and UDP connections
awk '{print $5}' | cut -d: -f1 |  # extract client IP addresses
sort | uniq -c | sort -nr         # show number of occurrences and sort by it

I want to do the same with connections that are going through the router's FORWARD chain.

share|improve this question
why the -1? can you explain? – LanceBaynes Jun 21 '11 at 8:40
1  
The fact that your questions are barely understandable probably doesn't help. I've done major rewrites to your last few, please look at the edits to see what I did. Don't worry so much about examples, they often just confuse things because your example aren't doing the right things. Focus on asking clear questions without abbreviations. If say something, then later feel like you have to say "I mean...", it you should just fix the first statement to use clear English. Sorry I don't know the answer to this question, but good luck, and I hope the edited version helps. – Caleb Jun 21 '11 at 15:36
@Caleb: Your edited question didn't make sense (it went: I know how to do X, how do I do X?) I've edited in turn; I think my version is what Lance intended, but that's always hard to tell. Repeating something in different words in case is actually a good idea, the problem here is that both versions were so vague. – Gilles Jun 21 '11 at 21:43
There seems to be two parts to your question: listing the connections, and extracting the information. You seem to only have a problem with the first part though. So including that whole script only made your question even harder to understand. And if you include a script like that, you definitely need to explain it, otherwise each reader has to first decode it (which requires familiarity with both netstat's output and text processing utilities). When you write questions, think of how people might or might not understand them. – Gilles Jun 21 '11 at 21:46
@Gilles: You're right I goobered the last line. The question in the first line was right and really I think that's the only part of this that is relevant at all, but the contradiction in the edit didn't help :) – Caleb Jun 21 '11 at 21:52

1 Answer

up vote 2 down vote accepted

If I understand your question correctly (which is always dubious with your questions), this isn't possible. Forwarding doesn't keep any state: the router receives a packet, analyses it, sends it onwards to its next destination, and forgets what the packet was. You can count or log packets, but you can't keep track of connections at that level.

It would make sense to count current NAT connections. All the connections that the netfilter subsystem keeps track of are listed in /proc/net/ip_conntrack. You can extract the client address with

sed -ne 's/^.*src=\([^ ]*\).*/\1/p' /proc/net/ip_conntrack
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.