Counters - Revision history

Pablo: incorrect syntax with protocol matching

2023-08-27T20:56:13Z

incorrect syntax with protocol matching

← Older revision		Revision as of 20:56, 27 August 2023
Line 10:		Line 10:
	type filter hook input priority filter; policy drop;		type filter hook input priority filter; policy drop;

	protocol tcp counter		ip protocol tcp counter
	}		}
	}		}
Line 17:		Line 17:
	'''Note''' that the position of the ''counter'' statement within your rule is significant, because nftables evaluates expressions and statements linearly from left to right. If the above rule were written instead:		'''Note''' that the position of the ''counter'' statement within your rule is significant, because nftables evaluates expressions and statements linearly from left to right. If the above rule were written instead:
	<source>		<source>
	counter protocol tcp		counter ip protocol tcp
	</source>		</source>

Fmyhr: /* Declaring and using named counters */ Add optional comment attribute.

2021-11-01T17:35:49Z

Declaring and using named counters: Add optional comment attribute.

← Older revision		Revision as of 17:35, 1 November 2021
Line 32:		Line 32:

	counter cnt_http {		counter cnt_http {
			comment "count both http and https packets"
	}		}

Line 47:		Line 48:
	</source>		</source>

	The above example defines two counters named ''cnt_http'' and ''cnt_smtp'' and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous [[Sets\|set]].)		The above example defines two counters named ''cnt_http'' and ''cnt_smtp'' and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous [[Sets\|set]].) The optional ''comment'' attribute requires at least nftables 0.9.7 and kernel 5.10.


	== Listing / reading named counters ==		== Listing / reading named counters ==

Phil: /* Resetting named counters */ Added workaround to reset anonymous counters

2021-06-10T13:32:13Z

Resetting named counters: Added workaround to reset anonymous counters

← Older revision		Revision as of 13:32, 10 June 2021
Line 139:		Line 139:

	'''Note:''' Resetting counters does not reset anonymous counters, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1401 bug #1401].		'''Note:''' Resetting counters does not reset anonymous counters, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1401 bug #1401].
			A workaround to achieve that is to restore the current ruleset with all stateful information dropped:
			<source>
			% (echo "flush ruleset"; nft --stateless list ruleset) \| nft -f -
			</source>
			Obviously, this drops all state so might have undesired side-effects, like, e.g. resetting quotas.

Fmyhr: Added notes about resetting counters. Fixed nft list counter example.

2021-04-06T20:51:24Z

Added notes about resetting counters. Fixed nft list counter example.

← Older revision		Revision as of 20:51, 6 April 2021
Line 58:		Line 58:
	* List a particular counter:		* List a particular counter:
	<source>		<source>
	% nft list counter named_counter_demo cnt_http		% nft list counter inet named_counter_demo cnt_http
	</source>		</source>

Line 120:		Line 120:

	== Resetting named counters ==		== Resetting named counters ==

			Resetting a counter dumps its current packet and byte counts and then resets the counts to their initial values.

	* Reset a particular counter:		* Reset a particular counter:
	<source>		<source>
	% nft reset counter named_counter_demo cnt_http		% nft reset counter inet named_counter_demo cnt_http
	</source>		</source>

Line 135:		Line 137:
	% nft reset counters		% nft reset counters
	</source>		</source>

			'''Note:''' Resetting counters does not reset anonymous counters, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1401 bug #1401].

Fmyhr: Intro: give brief summary of what counter counts.

2021-04-06T15:18:47Z

Intro: give brief summary of what counter counts.

← Older revision		Revision as of 15:18, 6 April 2021
Line 1:		Line 1:
	With nftables you need to explicitly specify a counter for each rule you want to count.		A counter counts both the total number of packets and the total bytes it has seen since it was last reset. With nftables you need to explicitly specify a counter for each rule you want to count.

	= Anonymous counters =		= Anonymous counters =

Fmyhr: Added example of reading named counters from Python, contributed by Frank Wunderlich and Anton Rieger.

2021-04-03T16:48:48Z

Added example of reading named counters from Python, contributed by Frank Wunderlich and Anton Rieger.

@@ Line 50: / Line 50: @@
-== Listing named counters ==
+== Listing / reading named counters ==
 * List a particular counter:
@@ Line 65: / Line 69: @@
 <source>
 % nft list counters
 </source>

Fmyhr: Added sections on listing and resetting named counters.

2021-04-02T13:42:13Z

Added sections on listing and resetting named counters.

@@ Line 1: / Line 1: @@
 With nftables you need to explicitly specify a counter for each rule you want to count.
 = Anonymous counters =
-The following example uses an unnamed counter to count all tcp traffic routed to your host:
+An anonymous counter is local to the single rule in which it appears. The following example uses an anonymous counter to count all tcp traffic routed to the local host:
 <source>
@@ Line 22: / Line 21: @@
 then '''every packet''' routed to your host (not just tcp packets) will update the counter!
 = Named counters =
-You can also declare named counters, which you can reference from multiple rules, e.g.:
+== Declaring and using named counters ==
 <source>
 table inet named_counter_demo {
      counter cnt_http {
+     }
@@ Line 35: / Line 40: @@
          type filter hook input priority filter; policy drop;
          tcp dport   80 counter name cnt_http
          tcp dport  443 counter name cnt_http
@@ Line 41: / Line 47: @@
 </source>
-The above example defines a named counter ''cnt_http'' and uses it in two rules in order to count both http and https packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; these two rules can easily be combined by using an anonymous [[Sets|set]].)
+The above example defines two counters named ''cnt_http'' and ''cnt_smtp'' and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous [[Sets|set]].)

Fmyhr: /* Anonymous counters */ clarity

2021-04-02T13:13:37Z

Anonymous counters: clarity

← Older revision		Revision as of 13:13, 2 April 2021
Line 21:		Line 21:
	</source>		</source>

	'''every packet''' routed to your host (not just tcp packets) will update the counter!		then '''every packet''' routed to your host (not just tcp packets) will update the counter!


	= Named counters =		= Named counters =

Fmyhr: New anonymous and named counter sections, additional example. Edited for clarity.

2021-04-02T13:10:59Z

New anonymous and named counter sections, additional example. Edited for clarity.

← Older revision		Revision as of 13:10, 2 April 2021
Line 1:		Line 1:
	~~Counters are optional in ''~~nftables~~'', thus,~~ you need to explicitly specify ~~them in the~~ rule if you want ~~them~~.		With nftables you need to explicitly specify a counter for each rule you want to count.

	~~The following example allows you to account all tcp traffic that you machine receives:~~

	<source ~~lang="bash"~~>		= Anonymous counters =
	~~% nft add rule~~ filter input ip protocol tcp counter
			The following example uses an unnamed counter to count all tcp traffic routed to your host:

			<source>
			table ip counter_demo {
			chain IN {
			type filter hook input priority filter; policy drop;

			protocol tcp counter
			}
			}
	</source>		</source>

	~~An interesting feature of~~ the ~~counter action is that its~~ position in the ~~rule syntax matters. This rule is~~ '''~~not~~'~~'' equivalent~~ to the ~~previous~~ rule:		'''Note''' that the position of the ''counter'' statement within your rule is significant, because nftables evaluates expressions and statements linearly from left to right. If the above rule were written instead:
			<source>
			counter protocol tcp
			</source>

	~~<source lang~~=~~"bash">~~		'''every packet''' routed to your host (not just tcp packets) will update the counter!
	~~% nft add rule filter input counter ip protocol tcp~~
	</source>
			= Named counters =

			You can also declare named counters, which you can reference from multiple rules, e.g.:
			<source>
			table inet named_counter_demo {

	~~The rule is evaluated from the left to the right, so '''any kind of packet''' will update the counters, not only TCP packets.~~		counter cnt_http {
			}

			chain IN {
			type filter hook input priority filter; policy drop;

	~~== Stateful counters ==~~		tcp dport 80 counter name cnt_http
			tcp dport 443 counter name cnt_http
			}
			}
			</source>

	~~nftables has native support for~~ '''~~stateful counters~~'~~'', i~~.~~e, counters not attached~~ to a ~~particular rule. Check the~~ [[~~Stateful_objects~~ \| ~~stateful objects~~]] ~~page for more details~~.		The above example defines a named counter ''cnt_http'' and uses it in two rules in order to count both http and https packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; these two rules can easily be combined by using an anonymous [[Sets\|set]].)

Arturo: add pointer to stateful counters

2020-07-21T13:21:55Z

add pointer to stateful counters

← Older revision		Revision as of 13:21, 21 July 2020
Line 14:		Line 14:

	The rule is evaluated from the left to the right, so '''any kind of packet''' will update the counters, not only TCP packets.		The rule is evaluated from the left to the right, so '''any kind of packet''' will update the counters, not only TCP packets.


			== Stateful counters ==

			nftables has native support for '''stateful counters''', i.e, counters not attached to a particular rule. Check the [[Stateful_objects \| stateful objects]] page for more details.