diff --git a/docs/Accounting.xml b/docs/Accounting.xml
index b23af231e..3b838b2c0 100644
--- a/docs/Accounting.xml
+++ b/docs/Accounting.xml
@@ -45,12 +45,12 @@
Accounting Basics
Shorewall accounting rules are described in the file
- /etc/shorewall/accounting. By default, the
- accounting rules are placed in a chain called accounting
- and can thus be displayed using shorewall[-lite] show
- accounting
. All traffic passing into, out of, or through the
- firewall traverses the accounting chain including traffic that will later
- be rejected by interface options such as tcpflags
and
+ /etc/shorewall/accounting. By default, the accounting
+ rules are placed in a chain called accounting
and can thus
+ be displayed using shorewall[-lite] show accounting
. All
+ traffic passing into, out of, or through the firewall traverses the
+ accounting chain including traffic that will later be rejected by
+ interface options such as tcpflags
and
maclist
. If your kernel doesn't support the connection
tracking match extension (Kernel 2.4.21) then some traffic rejected under
norfc1918
will not traverse the accounting chain.
@@ -76,12 +76,12 @@
<chain> - The name of a chain;
Shorewall will create the chain automatically if it doesn't
- already exist. A jump to this chain will be generated from
- the chain specified by the CHAIN column. If the name of the chain
- is followed by :COUNT
then a COUNT rule matching
- this entry will automatically be added to <chain>. Chain
- names must start with a letter, must be composed of letters and
- digits, and may contain underscores (_
) and periods
+ already exist. A jump to this chain will be generated from the
+ chain specified by the CHAIN column. If the name of the chain is
+ followed by :COUNT
then a COUNT rule matching this
+ entry will automatically be added to <chain>. Chain names
+ must start with a letter, must be composed of letters and digits,
+ and may contain underscores (_
) and periods
(.
). Beginning with Shorewall version 1.4.8, chain
names may also contain embedded dashes (-
) and are
not required to start with a letter.
@@ -117,8 +117,8 @@
- PROTOCOL - A protocol name (from
- /etc/protocols), a protocol number or
+ PROTOCOL - A protocol name
+ (from /etc/protocols), a protocol number or
ipp2p
. For ipp2p
, your kernel and
iptables must have ipp2p match support from Netfilter
@@ -128,8 +128,8 @@
DEST PORT - Destination Port
number. Service name from /etc/services or port
- number. May only be specified if the protocol is TCP or UDP (6 or
- 17). If the PROTOCOL is ipp2p
, then this column is
+ number. May only be specified if the protocol is TCP or UDP (6 or 17).
+ If the PROTOCOL is ipp2p
, then this column is
interpreted as an ipp2p option without the leading --
(default ipp2p
). For a list of value ipp2p options, as
root type iptables -m ipp2p --help.
@@ -171,13 +171,13 @@
MARK - Only count packets with
- particular mark values.
- [!]<value>[/<mask>][:C]
- Defines a test on the existing packet or connection mark. The rule will
- match only if the test returns true.
+ particular mark values. [!]<value>[/<mask>][:C]
+ Defines a test on the existing packet or connection mark. The rule
+ will match only if the test returns true.
If you don’t want to define a test but need to specify anything
- in the following columns, place a -
in this field.
+ in the following columns, place a -
in this
+ field.
! — Inverts the test (not equal)
<value> — Value of the packet or connection
@@ -193,8 +193,8 @@
- In all columns except ACTION and CHAIN, the values
- -
, any
and all
are treated as
+ In all columns except ACTION and CHAIN, the values -
,
+ any
and all
are treated as
wild-cards.
The accounting rules are evaluated in the Netfilter
@@ -224,9 +224,9 @@
web:COUNT - eth1 eth0 tcp - 443
DONE web
- Now shorewall show web (or shorewall-lite
- show web for Shorewall Lite users) will give you a breakdown
- of your web traffic:
+ Now shorewall show web (or
+ shorewall-lite show web for Shorewall Lite users) will
+ give you a breakdown of your web traffic:
[root@gateway shorewall]# shorewall show web
Shorewall-1.4.6-20030821 Chain web at gateway.shorewall.net - Wed Aug 20 09:48:56 PDT 2003
@@ -253,9 +253,9 @@
COUNT web eth0 eth1
COUNT web eth1 eth0
- Now shorewall show web (or shorewall-lite
- show web for Shorewall Lite users) simply gives you a
- breakdown by input and output:
+ Now shorewall show web (or
+ shorewall-lite show web for Shorewall Lite users)
+ simply gives you a breakdown by input and output:
[root@gateway shorewall]# shorewall show accounting web
Shorewall-1.4.6-20030821 Chains accounting web at gateway.shorewall.net - Wed Aug 20 10:27:21 PDT 2003
@@ -368,4 +368,13 @@
+
+
+ Integrating Shorewall Accounting with Collectd
+
+ Sergiusz Pawlowicz has written a nice article that shows how to
+ integrate Shorewall Accounting with collectd to produce nice graphs of
+ traffic activity. The article may be found at http://collectd.org/wiki/index.php/Plugin:IPTables.
+