Olaf Kirch - Linux Network Administrator Guide, Second Edition

Let's also imagine that for billing purposes we want to know the total traffic generated by each of the departments across the serial link, and for management purposes we want to know the total traffic generated between the two departments.

The following table shows the interface addresses we will use in our example:

To answer the question, "How much data does each department generate on the PPP link?", we could use a rule that looks like this:

# ipfwadm -A both -a -W ppp0 -S 172.16.3.0/24 -b

# ipfwadm -A both -a -W ppp0 -S 172.16.4.0/24 -b

or:

# ipchains -A input -i ppp0 -d 172.16.3.0/24

# ipchains -A output -i ppp0 -s 172.16.3.0/24

# ipchains -A input -i ppp0 -d 172.16.4.0/24

# ipchains -A output -i ppp0 -s 172.16.4.0/24

and with iptables:

# iptables -A FORWARD -i ppp0 -d 172.16.3.0/24

# iptables -A FORWARD -o ppp0 -s 172.16.3.0/24

# iptables -A FORWARD -i ppp0 -d 172.16.4.0/24

# iptables -A FORWARD -o ppp0 -s 172.16.4.0/24

The first half of each of these set of rules say, "Count all data traveling in either direction across the interface named ppp0 with a source or destination (remember the function of the -b flag in ipfwadm and iptables) address of 172.16.3.0/24. " The second half of each ruleset is the same, but for the second Ethernet network at our site.

To answer the second question, "How much data travels between the two departments?", we need a rule that looks like this:

# ipfwadm -A both -a -S 172.16.3.0/24 -D 172.16.4.0/24 -b

or:

# ipchains -A forward -s 172.16.3.0/24 -d 172.16.4.0/24 -b

or:

# iptables -A FORWARD -s 172.16.3.0/24 -d 172.16.4.0/24

# iptables -A FORWARD -s 172.16.4.0/24 -d 172.16.3.0/24

These rules will count all datagrams with a source address belonging to one of the department networks and a destination address belonging to the other.

Okay, let's suppose we also want a better idea of exactly what sort of traffic is being carried across our PPP link. We might, for example, want to know how much of the link the FTP, smtp, and World Wide Web services are consuming.

A script of rules to enable us to collect this information might look like:

#!/bin/sh

# Collect FTP, smtp and www volume statistics for data carried on our

# PPP link using ipfwadm

#

ipfwadm -A both -a -W ppp0 -P tcp -S 0/0 ftp ftp-data

ipfwadm -A both -a -W ppp0 -P tcp -S 0/0 smtp

ipfwadm -A both -a -W ppp0 -P tcp -S 0/0 www

or:

#!/bin/sh

# Collect ftp, smtp and www volume statistics for data carried on our

# PPP link using ipchains

#

ipchains -A input -i ppp0 -p tcp -s 0/0 ftp-data:ftp

ipchains -A output -i ppp0 -p tcp -d 0/0 ftp-data:ftp

ipchains -A input -i ppp0 -p tcp -s 0/0 smtp

ipchains -A output -i ppp0 -p tcp -d 0/0 smtp

ipchains -A input -i ppp0 -p tcp -s 0/0 www

ipchains -A output -i ppp0 -p tcp -d 0/0 www

or:

#!/bin/sh

# Collect ftp, smtp and www volume statistics for data carried on our

# PPP link using iptables.

#

iptables -A FORWARD -i ppp0 -m tcp -p tcp -sport ftp-data:ftp

iptables -A FORWARD -o ppp0 -m tcp -p tcp -dport ftp-data:ftp

iptables -A FORWARD -i ppp0 -m tcp -p tcp -sport smtp

iptables -A FORWARD -o ppp0 -m tcp -p tcp -dport smtp

iptables -A FORWARD -i ppp0 -m tcp -p tcp -sport www

iptables -A FORWARD -o ppp0 -m tcp -p tcp -dport www

There are a couple of interesting features to this configuration. Firstly, we've specified the protocol. When we specify ports in our rules, we must also specify a protocol because TCP and UDP provide separate sets of ports. Since all of these services are TCB-based, we've specified it as the protocol. Secondly, we've specified the two services ftp and ftp-data in one command. ipfwadm allows you to specify single ports, ranges of ports, or arbitrary lists of ports. The ipchains command allows either single ports or ranges of ports, which is what we've used here. The syntax " ftp-data:ftp " means "ports ftp-data (20) through ftp (21)," and is how we encode ranges of ports in both ipchains and iptables. When you have a list of ports in an accounting rule, it means that any data received for any of the ports in the list will cause the data to be added to that entry's totals. Remembering that the FTP service uses two ports, the command port and the data transfer port, we've added them together to total the FTP traffic. Lastly, we've specified the source address as " 0/0, " which is special notation that matches all addresses and is required by both the ipfwadm and ipchains commands in order to specify ports.

We can expand on the second point a little to give us a different view of the data on our link. Let's now imagine that we class FTP, SMTP, and World Wide Web traffic as essential traffic, and all other traffic as nonessential. If we were interested in seeing the ratio of essential traffic to nonessential traffic, we could do something like:

# ipfwadm -A both -a -W ppp0 -P tcp -S 0/0 ftp ftp-data smtp www

# ipfwadm -A both -a -W ppp0 -P tcp -S 0/0 1:19 22:24 26:79 81:32767

If you have already examined your /etc/services file, you will see that the second rule covers all ports except (ftp, ftp-data, smtp, and www).

How do we do this with the ipchains or iptables commands, since they allow only one argument in their port specification? We can exploit user-defined chains in accounting just as easily as in firewall rules. Consider the following approach:

# ipchains -N a-essent

# ipchains -N a-noness

# ipchains -A a-essent -j ACCEPT

# ipchains -A a-noness -j ACCEPT

# ipchains -A forward -i ppp0 -p tcp -s 0/0 ftp-data:ftp -j a-essent

# ipchains -A forward -i ppp0 -p tcp -s 0/0 smtp -j a-essent

# ipchains -A forward -i ppp0 -p tcp -s 0/0 www -j a-essent

# ipchains -A forward -j a-noness

Here we create two user-defined chains, one called a-essent, where we capture accounting data for essential services and another called a-noness, where we capture accounting data for nonessential services. We then add rules to our forward chain that match our essential services and jump to the a-essent chain, where we have just one rule that accepts all datagrams and counts them. The last rule in our forward chain is a rule that jumps to our a-noness chain, where again we have just one rule that accepts all datagrams and counts them. The rule that jumps to the a-noness chain will not be reached by any of our essential services, as they will have been accepted in their own chain. Our tallies for essential and nonessential services will therefore be available in the rules within those chains. This is just one approach you could take; there are others. Our iptables implementation of the same approach would look like: