Difference between revisions of "Counters"

From nftables wiki
Jump to navigation Jump to search
(Added example of reading named counters from Python, contributed by Frank Wunderlich and Anton Rieger.)
(→‎Declaring and using named counters: Add optional comment attribute.)
(3 intermediate revisions by 2 users not shown)
Line 1: Line 1:
With nftables you need to explicitly specify a counter for each rule you want to count.
A counter counts both the total number of packets and the total bytes it has seen since it was last reset. With nftables you need to explicitly specify a counter for each rule you want to count.


= Anonymous counters =
= Anonymous counters =
Line 32: Line 32:


     counter cnt_http {
     counter cnt_http {
        comment "count both http and https packets"
     }
     }


Line 47: Line 48:
</source>
</source>


The above example defines two counters named ''cnt_http'' and ''cnt_smtp'' and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous [[Sets|set]].)
The above example defines two counters named ''cnt_http'' and ''cnt_smtp'' and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous [[Sets|set]].) The optional ''comment'' attribute requires at least nftables 0.9.7 and kernel 5.10.
 


== Listing / reading named counters ==
== Listing / reading named counters ==
Line 58: Line 58:
* List a particular counter:
* List a particular counter:
<source>
<source>
% nft list counter named_counter_demo cnt_http
% nft list counter inet named_counter_demo cnt_http
</source>
</source>


Line 120: Line 120:


== Resetting named counters ==
== Resetting named counters ==
Resetting a counter dumps its current packet and byte counts and then resets the counts to their initial values.


* Reset a particular counter:
* Reset a particular counter:
<source>
<source>
% nft reset counter named_counter_demo cnt_http
% nft reset counter inet named_counter_demo cnt_http
</source>
</source>


Line 135: Line 137:
% nft reset counters
% nft reset counters
</source>
</source>
'''Note:''' Resetting counters does not reset anonymous counters, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1401 bug #1401].
A workaround to achieve that is to restore the current ruleset with all stateful information dropped:
<source>
% (echo "flush ruleset"; nft --stateless list ruleset) | nft -f -
</source>
Obviously, this drops all state so might have undesired side-effects, like, e.g. resetting quotas.

Revision as of 18:35, 1 November 2021

A counter counts both the total number of packets and the total bytes it has seen since it was last reset. With nftables you need to explicitly specify a counter for each rule you want to count.

Anonymous counters

An anonymous counter is local to the single rule in which it appears. The following example uses an anonymous counter to count all tcp traffic routed to the local host:

table ip counter_demo {
    chain IN {
        type filter hook input priority filter; policy drop;

        protocol tcp counter
    }
}

Note that the position of the counter statement within your rule is significant, because nftables evaluates expressions and statements linearly from left to right. If the above rule were written instead:

        counter protocol tcp

then every packet routed to your host (not just tcp packets) will update the counter!


Named counters

Declaring and using named counters

You can also declare named counters, which can be used in multiple rules, e.g.:

table inet named_counter_demo {

    counter cnt_http {
        comment "count both http and https packets"
    }

    counter cnt_smtp {
    }

    chain IN {
        type filter hook input priority filter; policy drop;

        tcp dport   25 counter name cnt_smtp
        tcp dport   80 counter name cnt_http
        tcp dport  443 counter name cnt_http
   }
}

The above example defines two counters named cnt_http and cnt_smtp and uses them in rules to count http(s) and smtp packets routed to the local host. (This example is contrived to show using a single named counter in multiple rules; the two rules using cnt_http can easily be combined by using an anonymous set.) The optional comment attribute requires at least nftables 0.9.7 and kernel 5.10.

Listing / reading named counters

Listing named counters from nft command line

nft list [counter | counters] (as per below) returns the current value(s) of the selected counter(s).

  • List a particular counter:
% nft list counter inet named_counter_demo cnt_http
  • List all counters in a particular table:
% nft list counters table inet named_counter_demo
  • List all counters in ruleset:
% nft list counters

Reading named counters from Python

The following partial ruleset (note the absence of a base chain) defines two named counters voip1 and voip2 and uses them to count VoIP traffic to udp/5160 and udp/5161. The commented-out rules show how to do this in simple fashion, while the 2 final rules in the FORWARD chain do the same thing using the voipcounters map. The approach using the map becomes increasingly advantageous when more ports (map elements) are added.

define ipvoipbox=192.168.0.8

table ip filter {
    counter voip1 {
    }
    counter voip2 {
    }
    map voipcounters {
        type inet_service : counter
        elements = {
            5160 : "voip1", 
            5161 : "voip2" 
        }
    }
    chain FORWARD {
        #ip saddr $ipvoipbox udp dport 5160 counter name voip1 comment "counting packets for SIP1"
        #ip daddr $ipvoipbox udp dport 5160 counter name voip1 comment "counting packets for SIP1"
        #ip saddr $ipvoipbox udp sport 5161 counter name voip2 comment "counting packets for SIP2"
        #ip daddr $ipvoipbox udp dport 5161 counter name voip2 comment "counting packets for SIP2"
        ip saddr $ipvoipbox counter name udp sport map @voipcounters
        ip daddr $ipvoipbox counter name udp dport map @voipcounters
    }
 }

We can read current counter values from Python using the libnftables library:

from nftables import Nftables
from nftables import json

def getCounter(countername, family='ip'):
    nft = Nftables()
    nft.set_json_output(True)
    _, output, _ = nft.cmd(f"list counter {family} filter {countername}")
    j = json.loads(output)
    return j['nftables'][1]["counter"]["bytes"]

print(getCounter('voip1'), 'bytes')
print(getCounter('voip2'), 'bytes')


Resetting named counters

Resetting a counter dumps its current packet and byte counts and then resets the counts to their initial values.

  • Reset a particular counter:
% nft reset counter inet named_counter_demo cnt_http
  • Reset all counters in a particular table:
% nft reset counters table inet named_counter_demo
  • Reset all counters in ruleset:
% nft reset counters

Note: Resetting counters does not reset anonymous counters, see bug #1401. A workaround to achieve that is to restore the current ruleset with all stateful information dropped:

% (echo "flush ruleset"; nft --stateless list ruleset) | nft -f -

Obviously, this drops all state so might have undesired side-effects, like, e.g. resetting quotas.