1

How can I log quantities of IP traffic by src/dst (and port for UDP & TCP)?

For each interval (probably each hour) I would like to see something like:

proto, src, dst, packets, octets
ICMP, 192.168.1.3, 2.3.4.5, 34, 483
TCP, 192.168.1.3:34821, 2.3.4.5:80, 123, 23408
TCP, 192.168.1.3:33812, 5.6.7.8:22, 201, 2039
TCP, 192.168.1.3:53, 1.1.1.1:53, 23, 3400
UDP, 192.168.1.3:53, 1.1.1.1:53, 323, 23403

For a gateway/router box, I expect thousands of lines each hour.

I know that iptables can count traffic, but as far as I have understood you need to know the addresses and ports before you start counting.

Is there a commonly used solution to counting all IP traffic?

(I am looking for a low-level tool/technique, not a function of a network management suite.)

Improve this question
2
  • 1
    conntrack do that. just set net.netfilter.nf_conntrack_acct=1 with sysctl
    – ibrahim
    Commented Oct 4, 2018 at 7:26
  • @ibrahim Thanks, could you turn that into an answer? Perhaps explain how you would get the information out of conntrack, and how you would zero the conntrack counters?
    – fadedbee
    Commented Oct 4, 2018 at 10:28

1 Answer 1

Reset to default
1

You can get byte and packet counts from conntrack.

To enable counters, set accounting

#sysctl net.netfilter.nf_conntrack_acct=1

Then you will see conntrack ouput like this

#conntrack -L
tcp      6 431971 ESTABLISHED src=192.168.0.156 dst=192.168.0.1 sport=53474 dport=443 packets=11 bytes=1945 src=192.168.0.1 dst=192.168.0.156 sport=443 dport=53474 packets=12 bytes=5238 [ASSURED] mark=0 use=1

You can zero counters with this command

#conntrack -L -z

Note that these counters are connection based. Conntrack entry will be removed once connection closed.

Check man page for more information

#man conntrack
Improve this answer
4
  • Do conntrack counters survive for any length of time after the connection is closed? If not, even running "conntrack -L" every minute will miss short-lived connections.
    – fadedbee
    Commented Oct 5, 2018 at 9:15
  • 1
    yes. you will lost data one the connection closed. maybe you can parse output of "conntrack -E" stream
    – ibrahim
    Commented Oct 6, 2018 at 16:57
  • Thanks, though I'll look at how conntrack -E gets its data, rather than parsing a format which might change.
    – fadedbee
    Commented Oct 9, 2018 at 9:43
  • 1
    conntrack gather informations from nf_conntrack kernel module. If you are interested, you can write your own simple module to gather data you want. Check this out stackoverflow.com/questions/39426783/…
    – ibrahim
    Commented Oct 10, 2018 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .