I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire set. Is there any way of finding accounting information for individual entries in an ipset being used by iptables?
you can use ULOG as a target and log the packets by it. Feeding mySQL/Postgres by ulogd is easy and then you can create such accounting info as you wish.
I have learned ipset after 6.19 include the accounting information I was looking for, according to http://marc.info/?l=netfilter&m=138289610522990