<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div><br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Jim Kinney" <jim.kinney@gmail.com><br><b>To: </b>"Chris Fowler" <cfowler@outpostsentinel.com><br><b>Cc: </b>"Atlanta Linux Enthusiasts - Yes! We run Linux!" <ale@ale.org><br><b>Sent: </b>Wednesday, August 12, 2015 3:36:48 PM<br><b>Subject: </b>Re: [ale] Monitor Internet Traffic<br><div><br></div><div>It used markers. So each source has it's own marker. Then each marker gets counted.</div><div><br></div><div>Ah! This looks familiar:</div><div><br></div><div><a href="http://www.catonmat.net/blog/traffic-accounting-with-iptables/" target="_blank" data-mce-href="http://www.catonmat.net/blog/traffic-accounting-with-iptables/">http://www.catonmat.net/blog/traffic-accounting-with-iptables/</a></div><div><br></div></blockquote><div><br></div><div>On a Pi2 I am trying to count addresses on ap0 (hostapd access point). I'm getting counts, but not by IP. I'm using the link above as an example</div><div><br></div><div>Here is iptables output:</div><div><br></div><div><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">pi@raspberrypi ~/MyPass $ sudo iptables -L -n -v -x</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain INPUT (policy ACCEPT 1451 packets, 150225 bytes)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 DROP udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 REJECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 reject-with tcp-reset</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><strong><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;" data-mce-style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Traffic is going to this chain</span></strong></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain FORWARD (policy ACCEPT 688 packets, 397481 bytes)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 552 521140 TRAFFIC_ACCT_OUT all -- * ap0 0.0.0.0/0 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 811 268100 TRAFFIC_ACCT_IN all -- ap0 * 0.0.0.0/0 0.0.0.0/0</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain OUTPUT (policy ACCEPT 793 packets, 78250 bytes)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain TRAFFIC_ACCT (0 references)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><strong><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;" data-mce-style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Traffic here too, but only counting by protocol. Not IP.</span></strong></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain TRAFFIC_ACCT_IN (1 references)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 0.0.0.0/0 192.168.42.2 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 0.0.0.0/0 192.168.42.3 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 0.0.0.0/0 192.168.42.4 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 0.0.0.0/0 192.168.42.5 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 0.0.0.0/0 192.168.42.6 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 410 133756 tcp -- * * 0.0.0.0/0 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 udp -- * * 0.0.0.0/0 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 icmp -- * * 0.0.0.0/0 0.0.0.0/0</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"><br></span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><strong><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;" data-mce-style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Not by IP here either.</span></strong></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">Chain TRAFFIC_ACCT_OUT (1 references)</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> pkts bytes target prot opt in out source destination </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 192.168.42.2 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 192.168.42.3 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 192.168.42.4 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 192.168.42.5 0.0.0.0/0 </span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"> 0 0 all -- * * 192.168.42.6 0.0.0.0/0</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">Here is iptables-save</p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">pi@raspberrypi ~/MyPass $ sudo iptables-save</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"># Generated by iptables-save v1.4.14 on Wed Aug 12 16:34:20 2015</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">*filter</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:INPUT ACCEPT [1574:161219]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:FORWARD ACCEPT [688:397481]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:OUTPUT ACCEPT [863:88166]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:TRAFFIC_ACCT - [0:0]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:TRAFFIC_ACCT_IN - [0:0]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:TRAFFIC_ACCT_OUT - [0:0]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A INPUT -i eth0 -p udp -m udp --dport 53 -j DROP</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A INPUT -i eth0 -p tcp -m tcp --dport 53 -j REJECT --reject-with tcp-reset</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A FORWARD -o ap0 -j TRAFFIC_ACCT_OUT</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A FORWARD -i ap0 -j TRAFFIC_ACCT_IN</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -d 192.168.42.2/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -d 192.168.42.3/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -d 192.168.42.4/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -d 192.168.42.5/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -d 192.168.42.6/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -p tcp</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -p udp</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_IN -p icmp</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_OUT -s 192.168.42.2/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_OUT -s 192.168.42.3/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_OUT -s 192.168.42.4/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_OUT -s 192.168.42.5/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A TRAFFIC_ACCT_OUT -s 192.168.42.6/32</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">COMMIT</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"># Completed on Wed Aug 12 16:34:20 2015</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"># Generated by iptables-save v1.4.14 on Wed Aug 12 16:34:20 2015</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">*nat</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:PREROUTING ACCEPT [890:216321]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:INPUT ACCEPT [173:24437]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:OUTPUT ACCEPT [24:1596]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">:POSTROUTING ACCEPT [2:96]</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A POSTROUTING -o eth0 -j MASQUERADE</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">-A POSTROUTING -o sta0 -j MASQUERADE</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;">COMMIT</span><br><span style="font-family: 'courier new', courier, monaco, monospace, sans-serif;"># Completed on Wed Aug 12 16:34:20 2015</span></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></br></p><p style="margin: 0px;" data-mce-style="margin: 0px;"><br></p><p style="margin: 0px;" data-mce-style="margin: 0px;">sta0 is a USB wifi dongle as a station. This device is not connected via Ethernet to my network. Only wireless. It serves up DHCP to a few devices. </p></div></div></body></html>