Because IP accounting feature is very closely related to the Linux

Transcription

1 Purpose It allows you to count and record incoming and outgoing bytes on a per port and address basis. With the addition of suitable software this would allow you to produce separate usage charges for each person using your systems networking capabilities. Because IP accounting feature is very closely related to the Linux firewall software, the same tool was designated to configure it, so ipfwadm, ipchains or iptables are used to configure IP accounting. To activate the Linux IP accounting feature, you should first see if your Linux kernel is configured for it. Check to see if the /proc/net/ip_acct file exists. If it does, your kernel already supports IP accounting. mywbut.com 1

2 Configuring IP Accounting The general syntax for IP accounting with ipfwadm is: # ipfwadm -A [direction] [command] [parameters] [The direction argument is new. This is simply coded as in, out, or both.] The general command syntax for ipchains and iptables is: # ipchains -A chain rule-specification # iptables -A chain rule-specification mywbut.com 2

3 Example Network Virtual Brewery ppp High-speed serial link Groucho Marx University mywbut.com 3

4 Accounting by Address How much data does each department generate on the PPP link?, # ipfwadm -A both -a -W ppp0 -S /24 -b # ipfwadm -A both -a -W ppp0 -S /24 -b # ipchains -A input -i ppp0 -d /24 # ipchains -A output -i ppp0 -s /24 # ipchains -A input -i ppp0 -d /24 # ipchains -A output -i ppp0 -s /24 and with iptables: # iptables -A FORWARD -i ppp0 -d /24 # iptables -A FORWARD -o ppp0 -s /24 # iptables -A FORWARD -i ppp0 -d /24 # iptables -A FORWARD -o ppp0 -s /24 mywbut.com 4

5 Accounting by Address How much data travels between the two departments # ipfwadm -A both -a -S /24 -D /24 -b # ipchains -A forward -s /24 -d /24 -b # iptables -A FORWARD -s /24 -d /24 # iptables -A FORWARD -s /24 -d /24 mywbut.com 5

6 Accounting by Service Port How much of the link the FTP, smtp, and World Wide Web services are consuming. #!/bin/sh # Collect ftp, smtp and www volume statistics for data carried on our # PPP link using iptables. # iptables -A FORWARD -i ppp0 -m tcp -p tcp --sport ftp-data:ftp iptables -A FORWARD -o ppp0 -m tcp -p tcp --dport ftp-data:ftp iptables -A FORWARD -i ppp0 -m tcp -p tcp --sport smtp iptables -A FORWARD -o ppp0 -m tcp -p tcp --dport smtp iptables -A FORWARD -i ppp0 -m tcp -p tcp --sport www iptables -A FORWARD -o ppp0 -m tcp -p tcp --dport www mywbut.com 6

7 Accounting by Protocol Let's now imagine that we are interested in knowing how much of the traffic on our link is TCP, UDP, and ICMP. We would use rules like the following: # ipfwadm -A both -a -W ppp0 -P tcp -D 0/0 # ipfwadm -A both -a -W ppp0 -P udp -D 0/0 # ipfwadm -A both -a -W ppp0 -P icmp -D 0/0 # ipchains -A forward -i ppp0 -p tcp -d 0/0 # ipchains -A forward -i ppp0 -p udp -d 0/0 # ipchains -A forward -i ppp0 -p icmp -d 0/0 # iptables -A FORWARD -i ppp0 -m tcp -p tcp # iptables -A FORWARD -o ppp0 -m tcp -p tcp # iptables -A FORWARD -i ppp0 -m udp -p udp # iptables -A FORWARD -o ppp0 -m udp -p udp # iptables -A FORWARD -i ppp0 -m icmp -p icmp # iptables -A FORWARD -o ppp0 -m icmp -p icmp mywbut.com 7

8 Listing Accounting Data with ipfwadm This will tell us the number of packets sent in each direction. If we use the extended output format with the e option (not shown here because the output is too wide for the page), we are also supplied the options and applicable interface names. mywbut.com 8

9 Listing Accounting Data with ipchains The simplest means of listing our accounting data with the ipchains is to use it like this: # ipchains -L v Again, just as with ipfwadm, we can display the packet and byte counters in units by using the expanded output mode. The ipchains uses the -x argument for this: # ipchains -L -v x mywbut.com 9

10 Listing Accounting Data with iptables To list our accounting data, we would use: # iptables -L v mywbut.com 10

11 Resetting the Counters The IP accounting counters will overflow if you leave them long enough. If they overflow, you will have difficulty determining the value they actually represent. To avoid this problem, you should read the accounting data periodically, record it, and then reset the counters back to zero to begin collecting accounting information for the next accounting interval. # ipfwadm -A -z # ipchains -Z # iptables Z You can even combine the list and zeroing actions together to ensure that no accounting data is lost in between: # ipfwadm -A -l -z # ipchains -L -Z # iptables -L -Z -v mywbut.com 11

12 Flushing the Rule set One last command that might be useful allows you to flush all the IP accounting rules you have configured. This is most useful when you want to radically alter your rule set without rebooting the machine. # ipfwadm -A -f # ipchains -F # iptables -F mywbut.com 12