Score:0

iptables: packets and bytes counters for nat

in flag

When listing the NAT rules, are the packets and byte counters reporting only inbound packets, or inbound and outbound packets?

I am trying to determine how many TCP connections were made. A connection (session) has 5 packets sent (by the client), but a variable number of packets received.

Command: iptables -t nat -v -L

Output:

 pkts bytes target     prot opt in     out     source               destination         
   60  3680 DNAT       all  --  wan0   any     anywhere             1.2.3.4        to:2.3.4.5

OS: Ubuntu 20.04 server

A.B avatar
cl flag
A.B
Too many unknows to answer. nat sees 1 packet per flow. And the rule isn't about TCP but everything (so also UDP, ICMP ...).
rwfbc avatar
in flag
The only traffic matching the rule is TCP. There could be some ICMP packets, but that is unlikely.
rwfbc avatar
in flag
"nat sees 1 packet per flow." That implies the metric is not really packets "translated", but flows translated, with an average of 61 bytes in the first packet of the flow that matches the rule. Correct.
Score:0
in flag

I was able to do some testing, and have confirmed that the counter labeled "pkts" is in fact a flow counter for the NAT table (in my case, TCP, it is equivalent to a session counter).

The "bytes" field is not really relevant for the NAT table (in my case the ~ 60 bytes are from the SYN packet).

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.