Since IPTABLES is a software based firewall, I am wondering if it is possible to log the exact load it is causing, cpu cycles, etc.

On a small system I am sure it is trivial. But how about with thousands of rules?

Looking in TOP and PS, this seems to elude me, so it must be a kernel level component?

Can it be isolated and monitored/logged?

eta: for clarity, on modern linux, iptables is not a visible process or daemon so it cannot be seen for example with ps aux and I am at a loss for how to isolate it from the kernel otherwise

  • The sy% in top tells you the percent of time the system is spending in kernel mode, as opposed to user mode. – LawrenceC Aug 21 '15 at 20:39
  • 1
    @ultrasawblade - that's a start but far from exactly monitoring iptables, etc. – ck_ Aug 21 '15 at 20:48

The actual processing of the iptables rules is done in softirq context so changes in the si% value in top (or %soft in mpstat) should give a hint about how much load it causes. If you want more details you could use the ftrace function tracer (see https://www.kernel.org/doc/Documentation/trace/ftrace.txt for more info) to log the calls to the respective kernel functions and measure the latency. However, this requires support in the kernel, i.e. specific kernel config options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.