missing network usage through iptables
- by Purres
I inserted a rule to iptables to track the input usage to a certain ip address. The vps server's IP is 192.168.1.5 and the guest os's IP is 192.168.1.115. I ran 'yum update' inside the guest OS to get some network traffic. Then I ran iptables -vnL from the hypervisor. However it only showed network usage to the host, but not to the guest.
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target source destination
0 0 0.0.0.0/0 0.0.0.0/0 destination IP range 192.168.1.115-192.168.1.115
1853 114K 0.0.0.0/0 0.0.0.0/0 destination IP range 192.168.1.5-192.168.1.5
I ran tcpdump and the log showed that there're data packets to the guest os.
16:17:43.932514 IP mirrordenver.fdcservers.net.http > 192.168.1.115.34471: Flags [.], seq 17694667:17696115, ack 1345, win 113, options [nop,nop,TS val 1060308643 ecr 1958781], length 1448
16:17:43.932559 IP 192.168.1.115.34471 > mirrordenver.fdcservers.net.http: Flags [.], ack 17696115, win 15287, options [nop,nop,TS val 1958869 ecr 1060308643], length 0
Why the guest OS network usage couldn't be tracked?
iptables -L will return the INPUT chain as following:
Chain INPUT (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere destination IP range 192.168.1.115-192.168.1.115
all -- anywhere anywhere destination IP range 192.168.1.5-192.168.1.5
all -- anywhere anywhere
