0

How do I account for the traffic using iptables? E.g. How can I follow how many resources scanning a single host require, in terms of network bandwidth ?

migrated from security.stackexchange.com Feb 20 at 18:26

This question came from our site for information security professionals.

  • 1
    I don't understand your question. Do you want to measure bandwidth and number of packets while running a scan? – Sjoerd Feb 20 at 14:24
  • I sense an X/Y problem. Forget about iptables for a moment, you just want to measure the impact of a scan? Scanners tell you the time it takes per scan per host. As for packets (which is what iptables would give you), you could simply run a packet capture. – schroeder Feb 20 at 14:36
  • Yes @schroeder, I want to measure the impact of a scan, let's say I perform a Nmap scan and it takes 159seconds, what does this tell me about the impact? – NowsyMe Feb 20 at 14:38
  • Nothing, but you asked for time, so there that is. The impact will be measured by load on the target. Network, CPU, RAM, and disk (for scans dealing with more than ports). I think you might need to rephrase the question to ask what you want to ask. – schroeder Feb 20 at 14:41
  • 1
    If you are focused on how to do this with iptables, then we should move this to another site, because it's just a configuration setting. – schroeder Feb 20 at 15:16
0
iptables -L -xvn

You will get both packet counts and bytes counts

Chain INPUT (policy ACCEPT 1428 packets, 42304 bytes)
    pkts      bytes target     prot opt in     out     source               destination
  147227 223766130 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
     556   184022 ACCEPT     udp  --  *      *       1.1.2.10         0.0.0.0/0            udp multiport dports 67,68
       0        0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    2723   382033 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp multiport dports 137,138
    9125  2151738 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp

In addition you can use ulogd version 2 to log traffic flows into a mysql database, but that seem less like what you want.

https://home.regit.org/2014/02/logging-connection-tracking-event-with-ulogd/

You might also consider iptraf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy