accounting — Shorewall Accounting file
/etc/shorewall/accounting
Accounting rules exist simply to count packets and bytes in categories that you define in this file. You may display these rules and their packet and byte counters using the shorewall show accounting command.
The columns in the file are as follows.
What to do when a matching packet is found.
Simply count the match and continue with the next rule
Count the match and don't attempt to match any other accounting rules in the chain specified in the CHAIN column.
Where chain is the name of a chain; Shorewall will create the chain automatically if it doesn't already exist. Causes a jump to that chain to be added to the chain specified in the CHAIN column. If :COUNT is included, a counting rule matching this entry will be added to chain
(Shorewall-perl only) The remainder of the line is treated as a comment which is attached to subsequent rules until another COMMENT line is found or until the end of the file is reached. To stop adding comments to rules, use a line with only the word COMMENT.
The name of a chain. If specified as - the accounting chain is assumed. This is the chain where the accounting rule is added. The chain will be created if it doesn't already exist.
Packet Source.
The name of an interface, an
address (host or net) or an
interface name followed by ":" and a host
or net address.
Packet Destination.
Format same as SOURCE column.
A protocol-name (from protocols(5)), a protocol-number, ipp2p, ipp2p:udp or ipp2p:all
Destination Port number. Service name from services(5) or port number. May only be specified if the protocol is tcp or udp (6 or 17).
You may place a comma-separated list of port names or numbers in this column if your kernel and iptables include multiport match support.
If the PROTOCOL is ipp2p then this column must contain an ipp2p-option ("iptables -m ipp2p --help") without the leading "--". If no option is given in this column, ipp2p is assumed.
Service name from services(5) or port number. May only be specified if the protocol is TCP or UDP (6 or 17).
You may place a comma-separated list of port numbers in this column if your kernel and iptables include multiport match support.
This column may only be non-empty if the CHAIN is OUTPUT.
When this column is non-empty, the rule applies only if the program generating the output is running under the effective user and/or group specified (or is NOT running under that id if "!" is given).
Examples:
program must be run by joe
program must be run by a member of the 'kids' group
program must not be run by a member of the 'kids' group
#program named upnpd
The ability to specify a program name was removed from Netfilter in kernel version 2.6.14.
Defines a test on the existing packet or connection mark. The rule will match only if the test returns true.
If you don't want to define a test but need to specify anything in the following columns, place a "-" in this field.
Inverts the test (not equal)
Value of the packet or connection mark.
A mask to be applied to the mark before testing.
Designates a connection mark. If omitted, the packet mark's value is tested. This option is only supported by Shorewall-perl.
In all of the above columns except ACTION and CHAIN, the values -, any and all may be used as wildcards. Omitted trailing columns are also treated as wildcards.
http://shorewall.net/Accounting.html
shorewall(8), shorewall-actions(5), shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5), shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5), shorewall-nat(5), shorewall-netmap(5), shorewall-params(5), shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5), shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5), shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)