While my brain still hot about this shorewall
I re-work bit of my accounting tables, to make it more fun:
#ACTION CHAIN SOURCE DESTINATION PROTOCOL DEST
SOURCE
# PORT PORT
total-i:COUNT - ppp0 -
total-o:COUNT - - ppp0
DONE total
hedges-i:COUNT - ppp0 10.1.1.5
hedges-o:COUNT - 10.1.1.5 ppp0
DONE hedges
peter-i:COUNT - ppp0 10.1.1.10
peter-o:COUNT - 10.1.1.10 ppp0
DONE peter
inneke-i:COUNT - ppp0 10.1.1.11
inneke-o:COUNT - 10.1.1.11 ppp0
DONE inneke
desi-i:COUNT - ppp0 10.1.1.12
desi-o:COUNT - 10.1.1.12 ppp0
DONE desi
compsusi-i:COUNT - ppp0 10.1.1.13
compsusi-o:COUNT - 10.1.1.13 ppp0
DONE compsusi
just right after I flush iptables, stop and start shorewall, here is the result:
> shorewall show accounting
Shorewall 4.0.14.2 Chain accounting at debian - Fri Dec 5 12:29:35 EST 2008
Counters reset Fri Dec 5 12:28:19 EST 2008
Chain accounting (3 references)
pkts bytes target prot opt in out source destination
786 332K total-i 0 -- ppp0 * 0.0.0.0/0 0.0.0.0/0
596 75409 total-o 0 -- * ppp0 0.0.0.0/0 0.0.0.0/0
253 257K hedges-i 0 -- ppp0 * 0.0.0.0/0 10.1.1.5
163 25018 hedges-o 0 -- * ppp0 10.1.1.5 0.0.0.0/0
9 1116 peter-i 0 -- ppp0 * 0.0.0.0/0 10.1.1.10
15 715 peter-o 0 -- * ppp0 10.1.1.10 0.0.0.0/0
216 30884 inneke-i 0 -- ppp0 * 0.0.0.0/0 10.1.1.11
170 30601 inneke-o 0 -- * ppp0 10.1.1.11 0.0.0.0/0
302 42748 desi-i 0 -- ppp0 * 0.0.0.0/0 10.1.1.12
242 18756 desi-o 0 -- * ppp0 10.1.1.12 0.0.0.0/0
0 0 compsusi-i 0 -- ppp0 * 0.0.0.0/0 10.1.1.13
0 0 compsusi-o 0 -- * ppp0 10.1.1.13 0.0.0.0/0
my questions are
host 'peter' and 'compsusi' is NOT ON at the moment
compsusi showing OK, which 0 - 0
why peter showing activity then?
I cant ping nor just browse to peter' comp, since its not on
Is there any suggestion on plug in to make this shorewall accounting more
'readable'?
I found a few solutions explaining how to extract these values and store it on
postgre,
but I just want to ask opinion from the expert or at least whomever already use
it for a while
Cheers
Start your day with Yahoo!7 and win a Sony Bravia TV. Enter now
http://au.docs.yahoo.com/homepageset/?p1=other&p2=au&p3=tagline
------------------------------------------------------------------------------
SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada.
The future of the web can't happen without you. Join us at MIX09 to help
pave the way to the Next Web now. Learn more and register at
http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
