The iptables has a clear (or zero) counters command.

Have a good read of the iptables manual which will give you command line options (including one which reports in numerical format that you will find easier for parsing).

Possibly one approach would be to run a daily cron job script. That script would query iptables for the current counters, and grep for the counters you want. It may then immediately call iptables again with the zero counters command.

There are, of course, hundreds of other approaches but that would be one way of approaching it.

(I'm assuming you know how to configure iptables and set up firewall rules/chains.. if not then you really are out of your depth and your time is best spent googling more information on iptables)

In reply to Re: iptables log auditing by monarch
in thread iptables log auditing by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.