2

If I run the command iptables -nvL on my VPS server running Ubuntu I get output like (output is much longer - I have only shown the interesting parts)

$ sudo iptables -nvL

Chain INPUT (policy DROP 41439 packets, 2499K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       91.234.36.0/24       0.0.0.0/0           
    0     0 DROP       all  --  *      *       223.255.252.0/23     0.0.0.0/0
    0     0 DROP       all  --  *      *       1.0.1.0/24           0.0.0.0/0           
 3102  261K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
 174K   54M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  495 26116 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
  331 14756 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723
   26  1468 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 7 prefix "iptables denied: "

Sometimes when I run this command I get results like

(policy DROP 41439 packets, 2499K bytes)

but then other times - from within the same shell - the data gets reset back to zero and it seems to start counting again. e.g.

(policy DROP 2 packets, 9K bytes)

If I switch to a different shell I will get the same data from the last shell.
My question is

  • Where is iptables is getting this info from?
    • log files?
    • does it start tracking internally from the first invocation of iptables -nvL?
  • How can I ensure the data doesn't reset back to zero?
2

Iptables keep a count (per chain) of packets processed. This two options could be used to change the count:

-Z, --zero [chain [rulenum]] Zero the packet and byte counters in all chains, or only the given chain, or only the given rule in a chain.

-c, --set-counters packets bytes This enables the administrator to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations).

Understand that some other process that calls iptables to execute INSERT, APPEND, or REPLACE operations will also change the count of packets.

  • thanks! this explained why the counter was reseting - it was because I was making changes to the iptables rules – the_velour_fog Feb 1 '16 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.