How can I check the hit count for each rule in iptables?
You can also use collectds iptables module to aggregate the counters:
https://collectd.org/wiki/index.php/Iptables
I use the following to check on my iptables rules:
iptables -nvL [INPUT|FORWARD|OUTPUT|myCHAINNAME] --line-numbers | less
The -n speeds up the process by not doing hostname lookups
The line numbers help with deleting rules:
iptables -D [INPUT|FORWARD|OUTPUT|myCHAINNAME] [Rule#]
iptables
will list packet and byte counters if you specify option -v
for verbose, e.g. iptables -vL
. Likewise iptables-save
will list all entries including the mentioned counters for each chain, but not for each table entry (on some systems iptables-save
requires option -c
to include counters).