Monitoring iptables processes

[mortain]

Hello there.

I'm looking for a way to monitoring iptables processes.
Since iptables acts directly into the kernel (correct me if I'm wrong), I tried to look into /proc to search for something interesting but found nothing.

Sometimes, some rules just don't work and I cannot know why, I need some monitoring tool, something like a grep, to see exactly what is iptables doing with some packet.

[atreyu]

Try the "LOG" function of iptables. It's not great but it is a start. See this thread for an example.

[Kloschüssel]

The simplest way would be to:

$ iptables -L -v

which lists all rules and the packet count (byte count) they matched. Together with the -Z switch you can actually get to pretty good snapshots and troubleshoot problems:

$ iptables -L -Z -v

But there's still the logging specified before that obviously can dump more information. Make sure to disable logging when you don't troubleshoot problems as it uses CPU cycles and fills the disk.