diff --git a/extensions/libxt_ACCOUNT.man b/extensions/libxt_ACCOUNT.man new file mode 100644 index 0000000..e80f5eb --- /dev/null +++ b/extensions/libxt_ACCOUNT.man @@ -0,0 +1,72 @@ +The ACCOUNT target is a high performance accounting system for large +local networks. It allows per-IP accounting in whole prefixes of IPv4 +addresses with size of up to /8 without the need to add individual +accouting rule for each IP address. +.PP +The ACCOUNT is designed to be queried for data every second or at +least every ten seconds. It is written as kernel module to handle high +bandwidths without packet loss. +.PP +The largest possible subnet size is 24 bit, meaning f.e. 10.0.0.0/8 +network. ACCOUNT uses fixed internal data structures +which speeds up the processing of each packet. Furthermore, +accounting data for one complete 192.168.1.X/24 network takes 4kb of +memory. Memory for 16 or 24 bit networks is only allocated when +needed. +.PP +To optimize the kernel<->userspace data transfer a bit more, the +kernel module only transfers information about IPs, where the src/dst +packet counter is not 0. This saves precious kernel time. +.PP +There is no /proc interface as it would be too slow for continuous access. +The read&flush query operation is the fastest, as no internal data +snapshot needs to be created&copied for all data. Use the "read" +operation without flush only for debugging purposes! +.PP +Usage: +.PP +ACCOUNT takes two mandatory parameters: +.TP +\fB--addr\fR \fInetwork/netmask\fR +where "network/netmask" is the subnet to account for, in CIDR syntax +.TP +\fB--tname\fP \fINAME\fP +where "NAME" is the name of the table where the accounting information +should be stored +.PP +Special case is subnet "0.0.0.0/0": all data are then stored in the src_bytes +and src_packets structure of slot "0". This is useful if you want +to account the overall traffic to/from your internet provider. +.PP +The data can be queried using the userspace libxt_ACCOUNT_cl library, +and by the reference implementation to show usage of this library, +the "iptaccount" tool, which features following options: +.PP +[\fB-u\fP] show kernel handle usage +.PP +[\fB-h\fP] free all kernel handles (experts only!) +.PP +[\fB-a\fP] list all table names +.PP +[\fB-l name\fP] show data in table \fBname\fP +.PP +[\fB-f\fP] flush data after showing +.PP +[\fB-c\fP] loop every second (abort with CTRL+C) +.PP +Here's an example of use: +.PP +iptables -A FORWARD -j ACCOUNT --addr 0.0.0.0/0 --tname all_outgoing +iptables -A FORWARD -j ACCOUNT --addr 192.168.1.0/24 --tname sales +.PP +This creates two tables called "all_outgoing" and "sales" which can be +queried using the userspace library/iptaccount tool. +.PP +Note that this target is non-terminating - the packet destined to it +will continue traversing the chain in which it has been used. +.PP +Also note that once a table has been defined for specific CIDR address/netmask +block, it can be referenced multiple times using -j ACCOUNT, provided +that both the original table name and address/netmask block are specified. +.PP +For more information go to http://www.intra2net.com/en/developer/ipt_ACCOUNT/