How to get metrics about dropped traffic via iptables

firewalliptablesnetworkingpacket

We are using iptables firewall. It is logging and dropping various packages depending on its defined rules.
Iptables log file entries look like: 

2017-08-08T19:42:38.237311-07:00 compute-nodeXXXXX kernel: [1291564.163235] drop-message : IN=vlanXXXX OUT=cali95ada065ccc MAC=24:6e:96:37:b9:f0:44:4c:XX:XX:XX:XX:XX:XX SRC=10.50.188.98 DST=10.49.165.68 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=14005 DF PROTO=TCP SPT=52862 DPT=50000 WINDOW=29200 RES=0x00 SYN URGP=0

Is there any way to get the count of the dropped packets ?
I want to calculate metrics like the number of dropped packets in the last minute, hour…. so on.

The main purpose is monitoring for configuration mistakes and security breaches. If the firewall rules have a mistake, abruptly bunch of packets start to get dropped. Similarly if an attack is happening we expect variation in the number of denied packets.

Best Answer

There are counters for each rule in iptables which can be shown with the -v option. Add -x to avoid the counters being abbreviated when they are very large (eg 1104K). For example,

$ sudo iptables -L -n -v -x
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target prot opt in out source    destination 
   39 22221 ACCEPT udp  --  *  *   0.0.0.0/0  0.0.0.0/0 udp spts:67:68 dpts:67:68
 ...
  182 43862 LOG    all  --  *  *   0.0.0.0/0  0.0.0.0/0 LOG flags 0 level 4 prefix "input_drop: "
  182 43862 REJECT all  --  *  *   0.0.0.0/0  0.0.0.0/0 reject-with icmp-host-prohibited

shows no dropped packets on my local network but 182 rejected with icmp and a log message such as the one you listed. The last two rules in the configuration with a policy of DROP were

  -A INPUT -j LOG --log-prefix "input_drop: "
  -A INPUT -j REJECT --reject-with icmp-host-prohibited

You can zero the counters for all chains with iptables -Z.

These counts are for the packets that iptables itself dropped. However, there may be other filtering software that is also dropping packets due to congestion, for example. You need to look at each one for whatever statistics they provide. The (obsolete) netstat program can easily show the counts of packets that were dropped at the ethernet interface due to congestion before they are even delivered to iptables:

$ netstat -i 
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR 
enp5s0    1500  1097107      0     38 0       2049166      0      0      0

and you can also get some statistics on packets dropped elsewhere by the kernel for various reasons:

$ netstat -s | grep -i drop
27 outgoing packets dropped
16 dropped because of missing route
2 ICMP packets dropped because socket was locked
Related Question