iptables Tips and Tricks – Track Bandwidth with iptables
By Mark Ridlen in Development, Tips and TricksAs I mentioned in my last post about CSF configuration in iptables, I’m working on a follow-up post about integrating CSF into cPanel, but I thought I’d inject a simple iptables use-case for bandwidth tracking. You probably think about iptables in terms of firewalls and security, but it also includes a great diagnostic tool for counting bandwidth for individual rules or set of rules. If you can block it, you can track it!
The best part about using iptables to track bandwidth is that the tracking is enabled by default. To see this feature in action, add the “-v” into the command:
[root@server ~]$ iptables -vnL Chain INPUT (policy ACCEPT 2495 packets, 104K bytes)
The output includes counters for both the policies and the rules. To track the rules, you can create a new chain for tracking bandwidth:
[root@server ~]$ iptables -N tracking [root@server ~]$ iptables -vnL ... Chain tracking (0 references) pkts bytes target prot opt in out source destination
Then you need to set up new rules to match the traffic that you wish to track. In this scenario, let’s look at inbound http traffic on port 80:
[root@server ~]$ iptables -I INPUT -p tcp --dport 80 -j tracking [root@server ~]$ iptables -vnL Chain INPUT (policy ACCEPT 35111 packets, 1490K bytes) pkts bytes target prot opt in out source destination 0 0 tracking tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
Now let’s generate some traffic and check it again:
[root@server ~]$ iptables -vnL Chain INPUT (policy ACCEPT 35216 packets, 1500K bytes) pkts bytes target prot opt in out source destination 101 9013 tracking tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
You can see the packet and byte transfer amounts to track the INPUT — traffic to a destination port on your server. If you want track the amount of data that the server is generating, you’d look for OUTPUT from the source port on your server:
See the OUTPUT Command and Learn More about Tracking Bandwidth with iptables »



