2

We are using iptables firewall. It is logging and dropping various packages depending on its defined rules. Iptables log file entries look like:

2017-08-08T19:42:38.237311-07:00 compute-nodeXXXXX kernel: [1291564.163235] drop-message : IN=vlanXXXX OUT=cali95ada065ccc MAC=24:6e:96:37:b9:f0:44:4c:XX:XX:XX:XX:XX:XX SRC=10.50.188.98 DST=10.49.165.68 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=14005 DF PROTO=TCP SPT=52862 DPT=50000 WINDOW=29200 RES=0x00 SYN URGP=0

Is there any way to get the count of the dropped packets ? I want to calculate metrics like the number of dropped packets in the last minute, hour…. so on.

The main purpose is monitoring for configuration mistakes and security breaches. If the firewall rules have a mistake, abruptly bunch of packets start to get dropped. Similarly if an attack is happening we expect variation in the number of denied packets.

  • Tailing and processing the iptables log could be one way to calculate this metric. That is not my preferred method. There are different types of messages in iptables log (not only drop messages). Sometimes if packets are dropped, a very large number of packets get dropped. The iptables log grows very fast very big. I do not want to write a complex high performance fault tolerant log tailer. – Hakan Baba Aug 9 '17 at 6:01
  • Have you looked at Graylog? – Simplexion Aug 9 '17 at 6:11
3

There are counters for each rule in iptables which can be shown with the -v option. Add -x to avoid the counters being abbreviated when they are very large (eg 1104K). For example,

$ sudo iptables -L -n -v -x
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target prot opt in out source    destination 
   39 22221 ACCEPT udp  --  *  *   0.0.0.0/0  0.0.0.0/0 udp spts:67:68 dpts:67:68
 ...
  182 43862 LOG    all  --  *  *   0.0.0.0/0  0.0.0.0/0 LOG flags 0 level 4 prefix "input_drop: "
  182 43862 REJECT all  --  *  *   0.0.0.0/0  0.0.0.0/0 reject-with icmp-host-prohibited

shows no dropped packets on my local network but 182 rejected with icmp and a log message such as the one you listed. The last two rules in the configuration with a policy of DROP were

  -A INPUT -j LOG --log-prefix "input_drop: "
  -A INPUT -j REJECT --reject-with icmp-host-prohibited

You can zero the counters for all chains with iptables -Z.


These counts are for the packets that iptables itself dropped. However, there may be other filtering software that is also dropping packets due to congestion, for example. You need to look at each one for whatever statistics they provide. The (obsolete) netstat program can easily show the counts of packets that were dropped at the ethernet interface due to congestion before they are even delivered to iptables:

$ netstat -i 
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR 
enp5s0    1500  1097107      0     38 0       2049166      0      0      0 

and you can also get some statistics on packets dropped elsewhere by the kernel for various reasons:

$ netstat -s | grep -i drop
27 outgoing packets dropped
16 dropped because of missing route
2 ICMP packets dropped because socket was locked
  • Thanks, this looks fantastic. Out of curiosity, is there another way to get these metrics without using iptables ? Is there another tool or interface in linux which has visibility to these metrics ? – Hakan Baba Aug 9 '17 at 15:30
  • Obviously, you can only get info about packets dropped by iptables from iptables. But packets can be dropped elsewhere. See my updated answer. – meuh Aug 9 '17 at 16:00
  • Thanks. Is there a way to get the metrics from iptables without being root ? For example could it be done with NET_ADMIN capability only ? – Hakan Baba Aug 9 '17 at 16:27
  • None of the CAP_NET_* capabilities seem enough for iptables to be able to use the netlink service to the kernel, so I don't know of any way to do without being root. – meuh Aug 9 '17 at 17:10
  • I was interested in your comment regarding sudo and netlink. After some investigation, I ended up asking a dedicated question for it. FYI. – Hakan Baba Aug 10 '17 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.