diff --git a/docs/Accounting.xml b/docs/Accounting.xml index b23af231e..3b838b2c0 100644 --- a/docs/Accounting.xml +++ b/docs/Accounting.xml @@ -45,12 +45,12 @@ Accounting Basics Shorewall accounting rules are described in the file - /etc/shorewall/accounting. By default, the - accounting rules are placed in a chain called accounting - and can thus be displayed using shorewall[-lite] show - accounting. All traffic passing into, out of, or through the - firewall traverses the accounting chain including traffic that will later - be rejected by interface options such as tcpflags and + /etc/shorewall/accounting. By default, the accounting + rules are placed in a chain called accounting and can thus + be displayed using shorewall[-lite] show accounting. All + traffic passing into, out of, or through the firewall traverses the + accounting chain including traffic that will later be rejected by + interface options such as tcpflags and maclist. If your kernel doesn't support the connection tracking match extension (Kernel 2.4.21) then some traffic rejected under norfc1918 will not traverse the accounting chain. @@ -76,12 +76,12 @@ <chain> - The name of a chain; Shorewall will create the chain automatically if it doesn't - already exist. A jump to this chain will be generated from - the chain specified by the CHAIN column. If the name of the chain - is followed by :COUNT then a COUNT rule matching - this entry will automatically be added to <chain>. Chain - names must start with a letter, must be composed of letters and - digits, and may contain underscores (_) and periods + already exist. A jump to this chain will be generated from the + chain specified by the CHAIN column. If the name of the chain is + followed by :COUNT then a COUNT rule matching this + entry will automatically be added to <chain>. Chain names + must start with a letter, must be composed of letters and digits, + and may contain underscores (_) and periods (.). Beginning with Shorewall version 1.4.8, chain names may also contain embedded dashes (-) and are not required to start with a letter. @@ -117,8 +117,8 @@ - PROTOCOL - A protocol name (from - /etc/protocols), a protocol number or + PROTOCOL - A protocol name + (from /etc/protocols), a protocol number or ipp2p. For ipp2p, your kernel and iptables must have ipp2p match support from Netfilter @@ -128,8 +128,8 @@ DEST PORT - Destination Port number. Service name from /etc/services or port - number. May only be specified if the protocol is TCP or UDP (6 or - 17). If the PROTOCOL is ipp2p, then this column is + number. May only be specified if the protocol is TCP or UDP (6 or 17). + If the PROTOCOL is ipp2p, then this column is interpreted as an ipp2p option without the leading -- (default ipp2p). For a list of value ipp2p options, as root type iptables -m ipp2p --help. @@ -171,13 +171,13 @@ MARK - Only count packets with - particular mark values. - [!]<value>[/<mask>][:C] - Defines a test on the existing packet or connection mark. The rule will - match only if the test returns true. + particular mark values. [!]<value>[/<mask>][:C] + Defines a test on the existing packet or connection mark. The rule + will match only if the test returns true. If you don’t want to define a test but need to specify anything - in the following columns, place a - in this field. + in the following columns, place a - in this + field. ! — Inverts the test (not equal) <value> — Value of the packet or connection @@ -193,8 +193,8 @@ - In all columns except ACTION and CHAIN, the values - -, any and all are treated as + In all columns except ACTION and CHAIN, the values -, + any and all are treated as wild-cards. The accounting rules are evaluated in the Netfilter @@ -224,9 +224,9 @@ web:COUNT - eth1 eth0 tcp - 443 DONE web - Now shorewall show web (or shorewall-lite - show web for Shorewall Lite users) will give you a breakdown - of your web traffic: + Now shorewall show web (or + shorewall-lite show web for Shorewall Lite users) will + give you a breakdown of your web traffic: [root@gateway shorewall]# shorewall show web Shorewall-1.4.6-20030821 Chain web at gateway.shorewall.net - Wed Aug 20 09:48:56 PDT 2003 @@ -253,9 +253,9 @@ COUNT web eth0 eth1 COUNT web eth1 eth0 - Now shorewall show web (or shorewall-lite - show web for Shorewall Lite users) simply gives you a - breakdown by input and output: + Now shorewall show web (or + shorewall-lite show web for Shorewall Lite users) + simply gives you a breakdown by input and output: [root@gateway shorewall]# shorewall show accounting web Shorewall-1.4.6-20030821 Chains accounting web at gateway.shorewall.net - Wed Aug 20 10:27:21 PDT 2003 @@ -368,4 +368,13 @@ + +
+ Integrating Shorewall Accounting with Collectd + + Sergiusz Pawlowicz has written a nice article that shows how to + integrate Shorewall Accounting with collectd to produce nice graphs of + traffic activity. The article may be found at http://collectd.org/wiki/index.php/Plugin:IPTables. +