Can't zero-out counters in iptables

didooofidooo · 02-25-2010, 12:15 AM

Hi everybody,

I have a problem with iptables, when I execute

Code:

iptables -Z INPUT

to zero out the chain, then execute

Code:

iptables -v -L INPUT

I find the chain's counters still the same, anyone knows why?

Thanks in advance.

david1941 · 02-25-2010, 12:21 AM

Using -Z [chain] zeros the counters. -X fails if any rules exist and does nothing.

win32sux · 02-25-2010, 09:52 AM

Also note that using -Z without specifying a chain wil reset the counters for all the chains. At least, it'll do that for the chains in the table you're working with (which is the filter table by default). To work with other tables just specify them, for example this command would reset the counters for all the chains in my nat table (PREROUTING, POSTROUTING, and OUTPUT):

Code:

iptables -Z -t nat

didooofidooo · 02-25-2010, 02:02 PM

Thank you guys so much, but I'm afraid this is not the problem.

The problem is that the chains' counters never get zeroed-out .... I tried all possible syntax, but nothing.

the only way the counters get zeroed out, by restarting the iptables service, or changing the chain's policy.

but anyway, thanks again.

win32sux · 02-25-2010, 02:24 PM

Quote:

Originally Posted by didooofidooo

Thank you guys so much, but I'm afraid this is not the problem.

The problem is that the chains' counters never get zeroed-out .... I tried all possible syntax, but nothing.

the only way the counters get zeroed out, by restarting the iptables service, or changing the chain's policy.

but anyway, thanks again.

You said you were doing a -X to zero out the chains. That would never work, as it has nothing to do with the counters. To zero a chain you need to use -Z, which is what has been suggested here. Can you confirm whether the counters decrease at all when you do it? Sometimes the counters begin to increase almost immediately after being zeroed, due to normal traffic.

didooofidooo · 02-25-2010, 02:51 PM

@win32sux : sorry that was just a typo, I'm using

iptables -t [table] -Z [chain]

to zero-out and

iptables -t [table] -v -L [chain]

to list the counters.

and about the counters being increased immediately after being zeroed-out, I don't think so, because the counters stays the same.