10

Are there any CLI or GUI functions that I can use to monitor hits to iptables and watch as packets interact with iptables?

5

You should be able to have this enabling modules ipt_LOG ipt6_LOG and using TRACE chain in raw table to debug streams/rules you need.

See http://backreference.org/2010/06/11/iptables-debugging/ for reference

  • Thats more like what I was after so see excactly which rules are being executed at which time. – pjf Aug 9 '13 at 7:54
16

Visualizing the rules

gressgraph

You can use this tool, gressgraph, to create a visualization of the rules.

  ss of gressgraph

dot-iptables

Another tool is called dot-iptables. It's a Python script that's similar to gressgraph.

graph-itables

A 3rd tool is called graph-iptables. This tool is a Perl script which is again similar to the previous 2.

Visualizing the logs

There is also a tool called Afterglow for visualizing the iptables log files. There's a nice tutorial available titled, Use Afterglow To Visualize Iptables Logs On CentOS, RHEL, Fedora.

  ss of afterglow

Realtime monitoring iptables

One method for doing this is to use a script, like this Perl script, to monitor iptables by running it every coule of seconds and collect the various counters on the different chains.

Another method is to use a top like tool called iptstate. You can also check out its man page too.

          ss of iptstate

You can see more screenshots here on the iptstate website.

  • excellent response, certainly opened my eyes up to some other possibilities. – pjf Aug 9 '13 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.