0

In my scenario, my host has a network interface with multiple IP addresses. I want to get the traffic of every IP address. I want to get received and sent packets and bytes, and error packets. My interface is:

qg-6108c4a2-94@if209: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fa:16:3e:9e:58:d2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 173.20.12.8/24 brd 173.20.12.255 scope global qg-6108c4a2-94
       valid_lft forever preferred_lft forever
    inet 173.20.12.7/32 brd 173.20.12.7 scope global qg-6108c4a2-94
       valid_lft forever preferred_lft forever
    inet 173.20.12.11/32 brd 173.20.12.11 scope global qg-6108c4a2-94
       valid_lft forever preferred_lft forever
    inet 173.20.12.13/32 brd 173.20.12.13 scope global qg-6108c4a2-94
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe9e:58d2/64 scope link
       valid_lft forever preferred_lft forever
6
  • Welcome to U&L! Please, clarify question. What do you want to count? Is it TCP/IP traffic or traffic about L2 protocols (i.e. Ethernet)? You mentioned about 'send packets and bytes and error packets'. This counters describes only Ethernet traffic so there is no sense collect it to each IP-address. Even thou you type: ifconfig qg-6108c4a2-94@if209:<sub_num> you will not see counters because PHY interface is single. If you want to collect traffic interchange by IP-addresses on L3 you need to use something like: iptables, netflow ... Apr 10, 2020 at 21:45
  • Are you wanting to monitor all traffic in and out of the machine (on this interface)? Or may be you are asking about measuring bandwidth used? or something else? Apr 10, 2020 at 22:06
  • @ctrl-alt-delor i want to monitor the traffic of every ip in a interface.
    – PZY
    Apr 11, 2020 at 3:00
  • @YurijGoncharuk i want to monitor every ip rx tx packets/bytes in this interface
    – PZY
    Apr 11, 2020 at 3:20
  • So you want to look inside the packets, see what they are. (probably for some debugging, training, spying, or security checking exercise). Is that correct? Every comment/answer I see is about counting. So answering the wrong question. Apr 11, 2020 at 9:06

1 Answer 1

1

You won't be able to get the information you want. The IPs are part of the same single interface, and as such, they are only counted at the physical level. I should note that "ifconfig" is insufficient and obsolete. The ip command will show you the summary at the physical level.

% ip -s link show br1000
10: br1000: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:10:18:aa:a8:20 brd ff:ff:ff:ff:ff:ff
RX: bytes  packets  errors  dropped overrun mcast
15661372003 108647365 0       0       0       0
TX: bytes  packets  errors  dropped carrier collsns
278081828962 149463091 0       0       0       0

You would need to use iptables or nftables to track what you're wanting to track.

# iptables example - probably incorrect, I don't have a dev machine to test this.
iptables -A INPUT -i br1000 -d 10.100.0.1/24 -j LOG
iptables -A OUTPUT -i br1000 -s 10.100.0.1/24 -j LOG

# nftables example - probably incorrect, I don't have a dev machine to test this.
nft add rule ip filter INPUT iifname "br1000" ip daddr 10.100.0.1 counter log
nft add rule ip filter OUTPUT iiname "br1000" ip saddr 10.100.0.1 counter log

There are other supplementary software that can help you as well - the first one that comes to mind is vnstat. But your mileage may vary.

2
  • are there more effective ways than iptables?
    – PZY
    Apr 11, 2020 at 8:42
  • Does this answer work for you? Have you now solved your problem? Apr 11, 2020 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .