The nfacct match provides the extended accounting infrastructure for iptables.

You have to use this match together with the standalone user-space utility

.B nfacct(8)

.PP

The only option available for this match is the following:

.TP

\fB\-\-nfacct\-name\fP \fIname\fP

This allows you to specify the existing object name that will be use for

accounting the traffic that this rule-set is matching.

.PP

To use this extension, you have to create an accounting object:

.IP

nfacct add http\-traffic

.PP

Then, you have to attach it to the accounting object via iptables:

.IP

iptables \-I INPUT \-p tcp \-\-sport 80 \-m nfacct \-\-nfacct\-name http\-traffic

.IP

iptables \-I OUTPUT \-p tcp \-\-dport 80 \-m nfacct \-\-nfacct\-name http\-traffic

.PP

Then, you can check for the amount of traffic that the rules match:

.IP

nfacct get http\-traffic

.IP

{ pkts = 00000000000000000156, bytes = 00000000000000151786 } = http-traffic;

.PP

You can obtain

.B nfacct(8)

from http://www.netfilter.org or, alternatively, from the git.netfilter.org

repository.