• Pablo Neira Ayuso's avatar
    netfilter: add extended accounting infrastructure over nfnetlink · 94139027
    Pablo Neira Ayuso authored
    We currently have two ways to account traffic in netfilter:
    
    - iptables chain and rule counters:
    
     # iptables -L -n -v
    Chain INPUT (policy DROP 3 packets, 867 bytes)
     pkts bytes target     prot opt in     out     source               destination
        8  1104 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    
    - use flow-based accounting provided by ctnetlink:
    
     # conntrack -L
    tcp      6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58152 dport=80 packets=47 bytes=7654 src=212.106.219.168 dst=192.168.1.130 sport=80 dport=58152 packets=49 bytes=66340 [ASSURED] mark=0 use=1
    
    While trying to display real-time accounting statistics, we require
    to pool the kernel periodically to obtain this information. This is
    OK if the number of flows is relatively low. However, in case that
    the number of flows is huge, we can spend a considerable amount of
    cycles to iterate over the list of flows that have been obtained.
    
    Moreover, if we want to obtain the sum of the flow accounting results
    that match some criteria, we have to iterate over the whole list of
    existing flows, look for matchings and update the counters.
    
    This patch adds the extended accounting infrastructure for
    nfnetlink which aims to allow displaying real-time traffic accounting
    without the need of complicated and resource-consuming implementation
    in user-space. Basically, this new infrastructure allows you to create
    accounting objects. One accounting object is composed of packet and
    byte counters.
    
    In order to manipulate create accounting objects, you require the
    new libnetfilter_acct library. It contains several examples of use:
    
    libnetfilter_acct/examples# ./nfacct-add http-traffic
    libnetfilter_acct/examples# ./nfacct-get
    http-traffic = { pkts = 000000000000,   bytes = 000000000000 };
    
    Then, you can use one of this accounting objects in several iptables
    rules using the new nfacct match (which comes in a follow-up patch):
    
     # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic
     # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic
    
    The idea is simple: if one packet matches the rule, the nfacct match
    updates the counters.
    
    Thanks to Patrick McHardy, Eric Dumazet, Changli Gao for reviewing and
    providing feedback for this contribution.
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    94139027
Makefile 5.29 KB