{"action":"opened","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1921","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1921/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1921/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1921/events","html_url":"https://github.com/facebook/osquery/issues/1921","id":140320431,"number":1921,"title":"iptables: Show per-rule packet/byte counts instead of per-policy counts","user":{"login":"djahandarie","id":21412,"avatar_url":"https://avatars.githubusercontent.com/u/21412?v=3","gravatar_id":"","url":"https://api.github.com/users/djahandarie","html_url":"https://github.com/djahandarie","followers_url":"https://api.github.com/users/djahandarie/followers","following_url":"https://api.github.com/users/djahandarie/following{/other_user}","gists_url":"https://api.github.com/users/djahandarie/gists{/gist_id}","starred_url":"https://api.github.com/users/djahandarie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djahandarie/subscriptions","organizations_url":"https://api.github.com/users/djahandarie/orgs","repos_url":"https://api.github.com/users/djahandarie/repos","events_url":"https://api.github.com/users/djahandarie/events{/privacy}","received_events_url":"https://api.github.com/users/djahandarie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-11T23:51:33Z","updated_at":"2016-03-11T23:51:33Z","closed_at":null,"body":"Right now, the `iptables` table has `packets` and `bytes` columns. Confusingly (to me), all the rows in my output had the same values for these columns.\r\n\r\nAfter looking through [osquery/tables/networking/linux/iptables.cpp](https://github.com/facebook/osquery/blob/master/osquery/tables/networking/linux/iptables.cpp), I realized that these columns do not correspond to the per-rule counters you see next to each rule when you run `iptables -L -v`, but instead the *policy* counters.\r\n\r\nIt looks like the iptables API does expose a function to get the per-rule counters:\r\n\r\n[struct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, unsigned int rulenum, iptc_handle_t *handle);](http://www.tldp.org/HOWTO/Querying-libiptc-HOWTO/qfunction.html#AEN588)\r\n\r\nI'm not sure if showing the policy counters instead of the per-row counters is considered a bug, but if the iptables table is intended to show information for rules, it's odd that it's showing information for policies instead. Either way, it would be very nice to have the per-rule counters accessible somehow."}}