BackupPC-users

[BackupPC-users] [OT] Using iptables for traffic accounting

2009-05-26 03:11:36
Subject: [BackupPC-users] [OT] Using iptables for traffic accounting
From: "Boniforti Flavio" <flavio AT piramide DOT ch>
To: "General list for user discussion, questions and support" <backuppc-users AT lists.sourceforge DOT net>
Date: Tue, 26 May 2009 09:07:11 +0200
Hello list,

I just wanted to report about using iptables to count the *real* amount
of traffic (data transferred). This is the output I got:

Chain INPUT (policy ACCEPT 22M packets, 55G bytes)
 pkts bytes target     prot opt in     out     source
destination
    0     0            tcp  --  *      *       0.0.0.0/0
127.0.0.1           tcp dpt:8876
    0     0            tcp  --  *      *       0.0.0.0/0
127.0.0.1           tcp dpt:8874
44908 2799K            tcp  --  *      *       0.0.0.0/0
127.0.0.1           tcp dpt:8875
 139K 7252K            tcp  --  *      *       0.0.0.0/0
127.0.0.1           tcp dpt:8873

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 14M packets, 30G bytes)
 pkts bytes target     prot opt in     out     source
destination
    0     0            tcp  --  *      *       127.0.0.1
0.0.0.0/0           tcp spt:8876
    0     0            tcp  --  *      *       127.0.0.1
0.0.0.0/0           tcp spt:8874
 139K 2290M            tcp  --  *      *       127.0.0.1
0.0.0.0/0           tcp spt:8873
45421  745M            tcp  --  *      *       127.0.0.1
0.0.0.0/0           tcp spt:8875

Note that I'm using SSH tunnels to rsync from remote hosts, thus I
needed to count the data transferred in these tunnels. The commands I
used are:

iptables -I INPUT -d localhost -p tcp --dport 8873
iptables -I INPUT -d localhost -p tcp --dport 8874
iptables -I INPUT -d localhost -p tcp --dport 8875
iptables -I INPUT -d localhost -p tcp --dport 8876

iptables -I OUTPUT -s localhost -p tcp --sport 8873
iptables -I OUTPUT -s localhost -p tcp --sport 8874
iptables -I OUTPUT -s localhost -p tcp --sport 8875
iptables -I OUTPUT -s localhost -p tcp --sport 8876

I'm using (at the moment) 4 tunnels and wanted to sum up the whole data
amount (thus INPUT and OUTPUT chain rules).

What my only concern is: why is rather my OUTPUT chain growing (2290M)
instead of my INPUT (I was expecting latter chain to grow, as I'm
"sucking" from the remote host).

Any clues about this thing, interpretations or something?

Thanks,
Flavio Boniforti

PIRAMIDE INFORMATICA SAGL
Via Ballerini 21
6600 Locarno
Switzerland
Phone: +41 91 751 68 81
Fax: +41 91 751 69 14
URL: http://www.piramide.ch
E-mail: flavio AT piramide DOT ch 

------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, & 
iPhoneDevCamp asthey present alongside digital heavyweights like Barbarian
Group, R/GA, & Big Spaceship. http://www.creativitycat.com 
_______________________________________________
BackupPC-users mailing list
BackupPC-users AT lists.sourceforge DOT net
List:    https://lists.sourceforge.net/lists/listinfo/backuppc-users
Wiki:    http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/