iptables-restore

package: iptables

title: iptables-restore(8)

summary: Restore IP Tables

text:
# iptables-restore(8)

## NAME
iptables-restore — Restore IP Tables

ip6tables-restore — Restore IPv6 Tables

## SYNOPSIS
iptables-restore [-chntvV] [-w seconds] [-M modprobe] [-T name] [file]

ip6tables-restore [-chntvV] [-w seconds] [-M modprobe] [-T name] [file]

## DESCRIPTION
iptables-restore and ip6tables-restore are used to restore IP and IPv6 Tables from data specified on STDIN or in file. Use I/O redirection provided by your shell to read from a file or specify file as an argument.

-c, --counters

Restore the values of all packet and byte counters.

-h, --help

Print a short option summary.

-n, --noflush

Don't flush the previous contents of the table. If not specified, both commands flush (delete) all previous contents of the respective table.

-t, --test

Only parse and construct the ruleset, but do not commit it.

-v, --verbose

Print additional debug info during ruleset processing. Specify multiple times to increase debug level.

-V, --version

Print the program version number.

-w, --wait [seconds]

Wait for the xtables lock. To prevent multiple instances of the program from running concurrently, an attempt will be made to obtain an exclusive lock at launch. By default, the program will exit if the lock cannot be obtained. This option will make the program wait (indefinitely or for optional seconds) until the exclusive lock can be obtained.

-M, --modprobe modprobe

Specify the path to the modprobe(8) program. By default, iptables-restore will inspect /proc/sys/kernel/modprobe to determine the executable's path.

-T, --table name

Restore only the named table even if the input stream contains other ones.

## BUGS
None known as of iptables-1.2.1 release

## AUTHORS
Harald Welte <laforge@gnumonks.org> wrote iptables-restore based on code from Rusty Russell.

Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.

## SEE ALSO
iptables-apply(8), iptables-save(8), iptables(8)

The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking-HOWTO which details the internals.


iptables-save

title: iptables-save(8)

summary: dump iptables rules

text:
# iptables-save(8)

## NAME
iptables-save — dump iptables rules

ip6tables-save — dump iptables rules

## SYNOPSIS
iptables-save [-M modprobe] [-c] [-t table] [-f filename]

ip6tables-save [-M modprobe] [-c] [-t table] [-f filename]

## DESCRIPTION
iptables-save and ip6tables-save are used to dump the contents of IP or IPv6 Table in easily parseable format either to STDOUT or to a specified file.

-M, --modprobe modprobe

Specify the path to the modprobe(8) program. By default, iptables-save will inspect /proc/sys/kernel/modprobe to determine the executable's path.

-f, --file filename

Specify a filename to log the output to. If not specified, iptables-save will log to STDOUT.

-c, --counters

Include the current values of all packet and byte counters in the output.

-t, --table tablename

Restrict output to only one table. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.

If not specified, output includes all available tables. No module loading takes place, so in order to include a specific table in the output, the respective module (something like iptable_mangle or ip6table_raw) must be loaded first.

## BUGS
None known as of iptables-1.2.1 release

## AUTHORS
Harald Welte <laforge@gnumonks.org>

Rusty Russell <rusty@rustcorp.com.au>

Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.

## SEE ALSO
iptables-apply(8), iptables-restore(8), iptables(8)

The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking-HOWTO which details the internals.


title: nfbpf_compile(8)

summary: generate bytecode for use with xt_bpf

text:
# nfbpf_compile(8)

## NAME
nfbpf_compile - generate bytecode for use with xt_bpf

## SYNOPSIS

nfbpf_compile [ LLTYPE ] PROGRAM

LLTYPE := { EN10MB | RAW | SLIP | ... }

## DESCRIPTION
The nfbpf_compile utility aids in generating BPF byte code suitable for passing to the iptables bpf match.

## OPTIONS
LLTYPE

Link-layer header type to operate on. This is a name as defined in <pcap/dlt.h> but with the leading DLT_ prefix stripped. For use with iptables, RAW should be the right choice (it's also the default if not specified).

PROGRAM

The BPF expression to compile, see pcap-filter(7) for a description of the language.

## EXIT STATUS
The program returns 0 on success, 1 otherwise.

## EXAMPLE
Match incoming TCP packets with size bigger than 100 bytes:

bpf=$(nfbpf_compile 'tcp and greater 100')

iptables -A INPUT -m bpf --bytecode "$bpf" -j ACCEPT

The description of bpf match in iptables-extensions(8) lists a few more examples.

## SEE ALSO
iptables-extensions(8), pcap-filter(7)


title: nfnl_osf(8)

summary: OS fingerprint loader utility

text:
# nfnl_osf(8)

## NAME
nfnl_osf - OS fingerprint loader utility

## SYNOPSIS

nfnl_osf -f fingerprints [ -d ]

## DESCRIPTION
The nfnl_osf utility allows to load a set of operating system signatures into the kernel for later matching against using iptables' osf match.

## OPTIONS
-f fingerprints

Read signatures from file fingerprints.

-d

Instead of adding the signatures from fingerprints into the kernel, remove them.

## EXIT STATUS
Exit status is 0 if command succeeded, otherwise a negative return code indicates the type of error which happened:

-1

Illegal arguments passed, fingerprints file not readable or failure in netlink communication.

-ENOENT

Fingerprints file not specified.

-EINVAL

Netlink handle initialization failed or fingerprints file format invalid.

## FILES
An up to date set of operating system signatures can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os .

## SEE ALSO
The description of osf match in iptables-extensions(8) contains further information about the topic as well as example nfnl_osf invocations.


xtables-legacy

title: xtables-legacy(8)

text:
# xtables-legacy(8)

## NAME
xtables-legacy — iptables using old getsockopt/setsockopt-based kernel api

## DESCRIPTION
xtables-legacy are the original versions of iptables that use old getsockopt/setsockopt-based kernel interface. This kernel interface has some limitations, therefore iptables can also be used with the newer nf_tables based API. See xtables-nft(8) for information about the xtables-nft variants of iptables.

## USAGE
The xtables-legacy-multi binary can be linked to the traditional names:

```
	/sbin/iptables -> /sbin/iptables-legacy-multi
	/sbin/ip6tables -> /sbin/ip6tables-legacy-multi
	/sbin/iptables-save -> /sbin/ip6tables-legacy-multi
	/sbin/iptables-restore -> /sbin/ip6tables-legacy-multi
```

The iptables version string will indicate whether the legacy API (get/setsockopt) or the new nf_tables API is used:

```
	iptables -V
	iptables v1.7 (legacy)
```

## LIMITATIONS
When inserting a rule using iptables -A or iptables -I, iptables first needs to retrieve the current active ruleset, change it to include the new rule, and then commit back the result. This means that if two instances of iptables are running concurrently, one of the updates might be lost. This can be worked around partially with the --wait option.

There is also no method to monitor changes to the ruleset, except periodically calling iptables-legacy-save and checking for any differences in output.

xtables-monitor(8) will need the xtables-nft(8) versions to work, it cannot display changes made using the iptables-legacy tools.

## SEE ALSO
xtables-nft(8), xtables-translate(8)

## AUTHORS
Rusty Russell originally wrote iptables, in early consultation with Michael Neuling.


arptables-nft

package: iptables-nft

title: arptables-nft(8)

summary: ARP table administration (nft-based)

text:
# arptables-nft(8)

## NAME
arptables - ARP table administration (nft-based)

## SYNOPSIS
arptables [-t table] -[AD] chain rule-specification [options]

arptables [-t table] -[RI] chain rulenum rule-specification [options]

arptables [-t table] -D chain rulenum [options]

arptables [-t table] -[LFZ] [chain] [options]

arptables [-t table] -[NX] chain

arptables [-t table] -E old-chain-name new-chain-name

arptables [-t table] -P chain target [options]

## DESCRIPTION
arptables is a user space tool, it is used to set up and maintain the tables of ARP rules in the Linux kernel. These rules inspect the ARP frames which they see. arptables is analogous to the iptables user space tool, but arptables is less complicated.

### CHAINS
The kernel table is used to divide functionality into different sets of rules. Each set of rules is called a chain. Each chain is an ordered list of rules that can match ARP frames. If a rule matches an ARP frame, then a processing specification tells what to do with that matching frame. The processing specification is called a 'target'. However, if the frame does not match the current rule in the chain, then the next rule in the chain is examined and so forth. The user can create new (user-defined) chains which can be used as the 'target' of a rule.

### TARGETS
A firewall rule specifies criteria for an ARP frame and a frame processing specification called a target. When a frame matches a rule, then the next action performed by the kernel is specified by the target. The target can be one of these values: ACCEPT, DROP, CONTINUE, RETURN, an 'extension' (see below) or a user-defined chain.

ACCEPT means to let the frame through. DROP means the frame has to be dropped. CONTINUE means the next rule has to be checked. This can be handy to know how many frames pass a certain point in the chain or to log those frames. RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. For the extension targets please see the TARGET EXTENSIONS section of this man page.

### TABLES
There is only one ARP table in the Linux kernel. The table is filter. You can drop the '-t filter' argument to the arptables command. The -t argument must be the first argument on the arptables command line, if used.

-t, --table

filter, is the only table and contains two built-in chains: INPUT (for frames destined for the host) and OUTPUT (for locally-generated frames).

## ARPTABLES COMMAND LINE ARGUMENTS
After the initial arptables command line argument, the remaining arguments can be divided into several different groups. These groups are commands, miscellaneous commands, rule-specifications, match-extensions, and watcher-extensions.

### COMMANDS
The arptables command arguments specify the actions to perform on the table defined with the -t argument. If you do not use the -t argument to name a table, the commands apply to the default filter table. With the exception of the -Z command, only one command may be used on the command line at a time.

-A, --append

Append a rule to the end of the selected chain.

-D, --delete

Delete the specified rule from the selected chain. There are two ways to use this command. The first is by specifying an interval of rule numbers to delete, syntax: start_nr[:end_nr]. Using negative numbers is allowed, for more details about using negative numbers, see the -I command. The second usage is by specifying the complete rule as it would have been specified when it was added.

-I, --insert

Insert the specified rule into the selected chain at the specified rule number. If the current number of rules equals N, then the specified number can be between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the same place in the chain where the rule should be inserted. The number 0 specifies the place past the last rule in the chain and using this number is therefore equivalent with using the -A command.

-R, --replace

Replaces the specified rule into the selected chain at the specified rule number. If the current number of rules equals N, then the specified number can be between 1 and N. i specifies the place in the chain where the rule should be replaced.

-P, --policy

Set the policy for the chain to the given target. The policy can be ACCEPT, DROP or RETURN.

-F, --flush

Flush the selected chain. If no chain is selected, then every chain will be flushed. Flushing the chain does not change the policy of the chain, however.

-Z, --zero

Set the counters of the selected chain to zero. If no chain is selected, all the counters are set to zero. The -Z command can be used in conjunction with the -L command. When both the -Z and -L commands are used together in this way, the rule counters are printed on the screen before they are set to zero.

-L, --list

List all rules in the selected chain. If no chain is selected, all chains are listed.

-N, --new-chain

Create a new user-defined chain with the given name. The number of user-defined chains is unlimited. A user-defined chain name has maximum length of 31 characters.

-X, --delete-chain

Delete the specified user-defined chain. There must be no remaining references to the specified chain, otherwise arptables will refuse to delete it. If no chain is specified, all user-defined chains that aren't referenced will be removed.

-E, --rename-chain

Rename the specified chain to a new name. Besides renaming a user-defined chain, you may rename a standard chain name to a name that suits your taste. For example, if you like PREBRIDGING more than PREROUTING, then you can use the -E command to rename the PREROUTING chain. If you do rename one of the standard arptables chain names, please be sure to mention this fact should you post a question on the arptables mailing lists. It would be wise to use the standard name in your post. Renaming a standard arptables chain in this fashion has no effect on the structure or function of the arptables kernel table.

### MISCELLANOUS COMMANDS
-V, --version

Show the version of the arptables userspace program.

-h, --help

Give a brief description of the command syntax.

-j, --jump target

The target of the rule. This is one of the following values: ACCEPT, DROP, CONTINUE, RETURN, a target extension (see TARGET EXTENSIONS) or a user-defined chain name.

-c, --set-counters PKTS BYTES

This enables the administrator to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations).

### RULE-SPECIFICATIONS
The following command line arguments make up a rule specification (as used in the add and delete commands). A "!" option before the specification inverts the test for that specification. Apart from these standard rule specifications there are some other command line arguments of interest.

-s, --source-ip [!] address[/mask]

The Source IP specification.

-d, --destination-ip [!] address[/mask]

The Destination IP specification.

--source-mac [!] address[/mask]

The source mac address. Both mask and address are written as 6 hexadecimal numbers separated by colons.

--destination-mac [!] address[/mask]

The destination mac address. Both mask and address are written as 6 hexadecimal numbers separated by colons.

-i, --in-interface [!] name

The interface via which a frame is received (for the INPUT chain). The flag --in-if is an alias for this option.

-o, --out-interface [!] name

The interface via which a frame is going to be sent (for the OUTPUT chain). The flag --out-if is an alias for this option.

-l, --h-length length[/mask]

The hardware length (nr of bytes)

--opcode code[/mask]

The operation code (2 bytes). Available values are: 1=Request 2=Reply 3=Request_Reverse 4=Reply_Reverse 5=DRARP_Request 6=DRARP_Reply 7=DRARP_Error 8=InARP_Request 9=ARP_NAK.

--h-type type[/mask]

The hardware type (2 bytes, hexadecimal). Available values are: 1=Ethernet.

--proto-type type[/mask]

The protocol type (2 bytes). Available values are: 0x800=IPv4.

### TARGET-EXTENSIONS
arptables extensions are precompiled into the userspace tool. So there is no need to explicitly load them with a -m option like in iptables. However, these extensions deal with functionality supported by supplemental kernel modules.

### mangle
--mangle-ip-s IP address

Mangles Source IP Address to given value.

--mangle-ip-d IP address

Mangles Destination IP Address to given value.

--mangle-mac-s MAC address

Mangles Source MAC Address to given value.

--mangle-mac-d MAC address

Mangles Destination MAC Address to given value.

--mangle-target target

Target of ARP mangle operation (DROP, CONTINUE or ACCEPT -- default is ACCEPT).

### CLASSIFY
This module allows you to set the skb->priority value (and thus clas- sify the packet into a specific CBQ class).

--set-class major:minor

Set the major and minor class value. The values are always interpreted as hexadecimal even if no 0x prefix is given.

### MARK
This module allows you to set the skb->mark value (and thus classify the packet by the mark in u32)

--set-mark mark

Set the mark value. The values are always interpreted as hexadecimal even if no 0x prefix is given

--and-mark mark

Binary AND the mark with bits.

--or-mark mark

Binary OR the mark with bits.

## NOTES
In this nft-based version of arptables, support for FORWARD chain has not been implemented. Since ARP packets are "forwarded" only by Linux bridges, the same may be achieved using FORWARD chain in ebtables.

## MAILINGLISTS
See http://netfilter.org/mailinglists.html

## SEE ALSO
xtables-nft(8), iptables(8), ebtables(8), ip(8)

See https://wiki.nftables.org


arptables-nft-restore

title: arptables-nft-restore(8)

summary: Restore ARP Tables (nft-based)

text:
# arptables-nft-restore(8)

## NAME
arptables-restore - Restore ARP Tables (nft-based)

## SYNOPSIS
arptables-restore

## DESCRIPTION
arptables-restore is used to restore ARP Tables from data specified on STDIN or via a file as first argument. Use I/O redirection provided by your shell to read from a file

arptables-restore

flushes (deletes) all previous contents of the respective ARP Table.

## AUTHOR
Jesper Dangaard Brouer <brouer@redhat.com>

## SEE ALSO
arptables-save(8), arptables(8)


arptables-nft-save

title: arptables-nft-save(8)

text:
# arptables-nft-save(8)

## NAME
arptables-save - dump arptables rules to stdout (nft-based)

## SYNOPSIS
arptables-save [-M modprobe] [-c]

arptables-save [-V]

## DESCRIPTION
arptables-save is used to dump the contents of an ARP Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file.

-M, --modprobe modprobe_program

Specify the path to the modprobe program. By default, arptables-save will inspect /proc/sys/kernel/modprobe to determine the executable's path.

-c, --counters

Include the current values of all packet and byte counters in the output.

-V, --version

Print version information and exit.

## AUTHOR
Jesper Dangaard Brouer <brouer@redhat.com>

## SEE ALSO
arptables-restore(8), arptables(8)


ebtables-nft

title: ebtables-nft(8)

text:
# ebtables-nft(8)

## NAME
ebtables - Ethernet bridge frame table administration (nft-based)

## SYNOPSIS
ebtables [-t table ] -[ACDI] chain rule specification [match extensions] [watcher extensions] target

ebtables [-t table ] -P chain ACCEPT | DROP | RETURN

ebtables [-t table ] -F [chain]

ebtables [-t table ] -Z [chain]

ebtables [-t table ] -L [-Z] [chain] [ [--Ln] | [--Lx] ] [--Lc] [--Lmac2]

ebtables [-t table ] -N chain [-P ACCEPT | DROP | RETURN]

ebtables [-t table ] -X [chain]

ebtables [-t table ] -E old-chain-name new-chain-name

ebtables [-t table ] --init-table

## DESCRIPTION
ebtables is an application program used to set up and maintain the tables of rules (inside the Linux kernel) that inspect Ethernet frames. It is analogous to the iptables application, but less complicated, due to the fact that the Ethernet protocol is much simpler than the IP protocol.

### CHAINS
There are three ebtables tables with built-in chains in the Linux kernel. These tables are used to divide functionality into different sets of rules. Each set of rules is called a chain. Each chain is an ordered list of rules that can match Ethernet frames. If a rule matches an Ethernet frame, then a processing specification tells what to do with that matching frame. The processing specification is called a 'target'. However, if the frame does not match the current rule in the chain, then the next rule in the chain is examined and so forth. The user can create new (user-defined) chains that can be used as the 'target' of a rule. User-defined chains are very useful to get better performance over the linear traversal of the rules and are also essential for structuring the filtering rules into well-organized and maintainable sets of rules.

### TARGETS
A firewall rule specifies criteria for an Ethernet frame and a frame processing specification called a target. When a frame matches a rule, then the next action performed by the kernel is specified by the target. The target can be one of these values: ACCEPT, DROP, CONTINUE, RETURN, an 'extension' (see below) or a jump to a user-defined chain.

ACCEPT means to let the frame through. DROP means the frame has to be dropped. In the BROUTING chain however, the ACCEPT and DROP target have different meanings (see the info provided for the -t option). CONTINUE means the next rule has to be checked. This can be handy, f.e., to know how many frames pass a certain point in the chain, to log those frames or to apply multiple targets on a frame. RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. For the extension targets please refer to the TARGET EXTENSIONS section of this man page.

### TABLES
As stated earlier, the table names are filter, nat and broute. Of these tables, the filter table is the default table that the command operates on. If you are working with a table other than filter, you will need to provide the -t argument. Moreover, the -t argument must be the first argument on the ebtables command line, if used.

-t, --table

filter is the default table and contains three built-in chains: INPUT (for frames destined for the bridge itself, on the level of the MAC destination address), OUTPUT (for locally-generated or (b)routed frames) and FORWARD (for frames being forwarded by the bridge).

nat is mostly used to change the mac addresses and contains three built-in chains: PREROUTING (for altering frames as soon as they come in), OUTPUT (for altering locally generated or (b)routed frames before they are bridged) and POSTROUTING (for altering frames as they are about to go out). A small note on the naming of chains PREROUTING and POSTROUTING: it would be more accurate to call them PREFORWARDING and POSTFORWARDING, but for all those who come from the iptables world to ebtables it is easier to have the same names. Note that you can change the name (-E) if you don't like the default.

broute is used to make a brouter, it has one built-in chain: BROUTING. The targets DROP and ACCEPT have a special meaning in the broute table (these names are used for compatibility reasons with ebtables-legacy). DROP actually means the frame has to be routed, while ACCEPT means the frame has to be bridged. The BROUTING chain is traversed very early. Normally those frames would be bridged, but you can decide otherwise here.

## EBTABLES COMMAND LINE ARGUMENTS
After the initial ebtables '-t table' command line argument, the remaining arguments can be divided into several groups. These groups are commands, miscellaneous commands, rule specifications, match extensions, watcher extensions and target extensions.

### COMMANDS
The ebtables command arguments specify the actions to perform on the table defined with the -t argument. If you do not use the -t argument to name a table, the commands apply to the default filter table. Only one command may be used on the command line at a time, except when the commands -L and -Z are combined or the commands -N and -P are combined.

-A, --append

Append a rule to the end of the selected chain.

-D, --delete

Delete the specified rule or rules from the selected chain. There are two ways to use this command. The first is by specifying an interval of rule numbers to delete (directly after -D). Syntax: start_nr[:end_nr] (use -L --Ln to list the rules with their rule number). When end_nr is omitted, all rules starting from start_nr are deleted. Using negative numbers is allowed, for more details about using negative numbers, see the -I command. The second usage is by specifying the complete rule as it would have been specified when it was added. Only the first encountered rule that is the same as this specified rule, in other words the matching rule with the lowest (positive) rule number, is deleted.

-C, --change-counters

Change the counters of the specified rule or rules from the selected chain. There are two ways to use this command. The first is by specifying an interval of rule numbers to do the changes on (directly after -C). Syntax: start_nr[:end_nr] (use -L --Ln to list the rules with their rule number). The details are the same as for the -D command. The second usage is by specifying the complete rule as it would have been specified when it was added. Only the counters of the first encountered rule that is the same as this specified rule, in other words the matching rule with the lowest (positive) rule number, are changed. In the first usage, the counters are specified directly after the interval specification, in the second usage directly after -C. First the packet counter is specified, then the byte counter. If the specified counters start with a '+', the counter values are added to the respective current counter values. If the specified counters start with a '-', the counter values are decreased from the respective current counter values. No bounds checking is done. If the counters don't start with '+' or '-', the current counters are changed to the specified counters.

-I, --insert

Insert the specified rule into the selected chain at the specified rule number. If the rule number is not specified, the rule is added at the head of the chain. If the current number of rules equals N, then the specified number can be between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the same place in the chain where the rule should be inserted. The rule number 0 specifies the place past the last rule in the chain and using this number is therefore equivalent to using the -A command. Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted in a chain.

-P, --policy

Set the policy for the chain to the given target. The policy can be ACCEPT, DROP or RETURN.

-F, --flush

Flush the selected chain. If no chain is selected, then every chain will be flushed. Flushing a chain does not change the policy of the chain, however.

-Z, --zero

Set the counters of the selected chain to zero. If no chain is selected, all the counters are set to zero. The -Z command can be used in conjunction with the -L command. When both the -Z and -L commands are used together in this way, the rule counters are printed on the screen before they are set to zero.

-L, --list

List all rules in the selected chain. If no chain is selected, all chains are listed.

The following options change the output of the -L command.

--Ln

Places the rule number in front of every rule. This option is incompatible with the --Lx option.

--Lc

Shows the counters at the end of each rule displayed by the -L command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed. The frame counter shows how many frames have matched the specific rule, the byte counter shows the sum of the frame sizes of these matching frames. Using this option in combination with the --Lx option causes the counters to be written out in the '-c <pcnt> <bcnt>' option format.

--Lx

Changes the output so that it produces a set of ebtables commands that construct the contents of the chain, when specified. If no chain is specified, ebtables commands to construct the contents of the table are given, including commands for creating the user-defined chains (if any). You can use this set of commands in an ebtables boot or reload script. For example the output could be used at system startup. The --Lx option is incompatible with the --Ln listing option. Using the --Lx option together with the --Lc option will cause the counters to be written out in the '-c <pcnt> <bcnt>' option format.

--Lmac2

Shows all MAC addresses with the same length, adding leading zeroes if necessary. The default representation omits leading zeroes in the addresses.

-N, --new-chain

Create a new user-defined chain with the given name. The number of user-defined chains is limited only by the number of possible chain names. A user-defined chain name has a maximum length of 31 characters. The standard policy of the user-defined chain is ACCEPT. The policy of the new chain can be initialized to a different standard target by using the -P command together with the -N command. In this case, the chain name does not have to be specified for the -P command.

-X, --delete-chain

Delete the specified user-defined chain. There must be no remaining references (jumps) to the specified chain, otherwise ebtables will refuse to delete it. If no chain is specified, all user-defined chains that aren't referenced will be removed.

-E, --rename-chain

Rename the specified chain to a new name. Besides renaming a user-defined chain, you can rename a standard chain to a name that suits your taste. For example, if you like PREFORWARDING more than PREROUTING, then you can use the -E command to rename the PREROUTING chain. If you do rename one of the standard ebtables chain names, please be sure to mention this fact should you post a question on the ebtables mailing lists. It would be wise to use the standard name in your post. Renaming a standard ebtables chain in this fashion has no effect on the structure or functioning of the ebtables kernel table.

--init-table

Replace the current table data by the initial table data.

### MISCELLANOUS COMMANDS
-v, --verbose

Verbose mode. For appending, insertion, deletion and replacement, this causes detailed information on the rule or rules to be printed. -v may be specified multiple times to possibly emit more detailed debug statements.

-V, --version

Show the version of the ebtables userspace program.

-h, --help [list of module names]

Give a brief description of the command syntax. Here you can also specify names of extensions and ebtables will try to write help about those extensions. E.g. ebtables -h snat log ip arp. Specify list_extensions to list all extensions supported by the userspace utility.

-j, --jump target

The target of the rule. This is one of the following values: ACCEPT, DROP, CONTINUE, RETURN, a target extension (see TARGET EXTENSIONS) or a user-defined chain name.

-M, --modprobe program

When talking to the kernel, use this program to try to automatically load missing kernel modules.

--concurrent

Use a file lock to support concurrent scripts updating the ebtables kernel tables.

### RULE SPECIFICATIONS
The following command line arguments make up a rule specification (as used in the add and delete commands). A "!" option before the specification inverts the test for that specification. Apart from these standard rule specifications there are some other command line arguments of interest. See both the MATCH EXTENSIONS and the WATCHER EXTENSIONS below.

-p, --protocol [!] protocol

The protocol that was responsible for creating the frame. This can be a hexadecimal number, above 0x0600, a name (e.g. ARP ) or LENGTH. The protocol field of the Ethernet frame can be used to denote the length of the header (802.2/802.3 networks). When the value of that field is below or equals 0x0600, the value equals the size of the header and shouldn't be used as a protocol number. Instead, all frames where the protocol field is used as the length field are assumed to be of the same 'protocol'. The protocol name used in ebtables for these frames is LENGTH.

The file /etc/ethertypes can be used to show readable characters instead of hexadecimal numbers for the protocols. For example, 0x0800 will be represented by IPV4. The use of this file is not case sensitive. See that file for more information. The flag --proto is an alias for this option.

-i, --in-interface [!] name

The interface (bridge port) via which a frame is received (this option is useful in the INPUT, FORWARD, PREROUTING and BROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') will match. The flag --in-if is an alias for this option.

--logical-in [!] name

The (logical) bridge interface via which a frame is received (this option is useful in the INPUT, FORWARD, PREROUTING and BROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') will match.

-o, --out-interface [!] name

The interface (bridge port) via which a frame is going to be sent (this option is useful in the OUTPUT, FORWARD and POSTROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') will match. The flag --out-if is an alias for this option.

--logical-out [!] name

The (logical) bridge interface via which a frame is going to be sent (this option is useful in the OUTPUT, FORWARD and POSTROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') will match.

-s, --source [!] address[/mask]

The source MAC address. Both mask and address are written as 6 hexadecimal numbers separated by colons. Alternatively one can specify Unicast, Multicast, Broadcast or BGA (Bridge Group Address):

Unicast=00:00:00:00:00:00/01:00:00:00:00:00, Multicast=01:00:00:00:00:00/01:00:00:00:00:00, Broadcast=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or BGA=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff. Note that a broadcast address will also match the multicast specification. The flag --src is an alias for this option.

-d, --destination [!] address[/mask]

The destination MAC address. See -s (above) for more details on MAC addresses. The flag --dst is an alias for this option.

-c, --set-counter pcnt bcnt

If used with -A or -I, then the packet and byte counters of the new rule will be set to pcnt, resp. bcnt. If used with the -C or -D commands, only rules with a packet and byte count equal to pcnt, resp. bcnt will match.

### MATCH EXTENSIONS
Ebtables extensions are dynamically loaded into the userspace tool, there is therefore no need to explicitly load them with a -m option like is done in iptables. These extensions deal with functionality supported by kernel modules supplemental to the core ebtables code.

### 802_3
Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as LENGTH (see the option -p above).

--802_3-sap [!] sap

DSAP and SSAP are two one byte 802.3 fields. The bytes are always equal, so only one byte (hexadecimal) is needed as an argument.

--802_3-type [!] type

If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must be consulted to determine the payload protocol. This is a two byte (hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are checked for type.

### among
Match a MAC address or MAC/IP address pair versus a list of MAC addresses and MAC/IP address pairs. A list entry has the following format: xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,]. Multiple list entries are separated by a comma, specifying an IP address corresponding to the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address but different IP address (and vice versa) can be specified. If the MAC address doesn't match any entry from the list, the frame doesn't match the rule (unless "!" was used).

--among-dst [!] list

Compare the MAC destination to the given list. If the Ethernet frame has type IPv4 or ARP, then comparison with MAC/IP destination address pairs from the list is possible.

--among-src [!] list

Compare the MAC source to the given list. If the Ethernet frame has type IPv4 or ARP, then comparison with MAC/IP source address pairs from the list is possible.

--among-dst-file [!] file

Same as --among-dst but the list is read in from the specified file.

--among-src-file [!] file

Same as --among-src but the list is read in from the specified file.

### arp
Specify (R)ARP fields. The protocol must be specified as ARP or RARP.

--arp-opcode [!] opcode

The (R)ARP opcode (decimal or a string, for more details see ebtables -h arp).

--arp-htype [!] hardware type

The hardware type, this can be a decimal or the string Ethernet (which sets type to 1). Most (R)ARP packets have Eternet as hardware type.

--arp-ptype [!] protocol type

The protocol type for which the (r)arp is used (hexadecimal or the string IPv4, denoting 0x0800). Most (R)ARP packets have protocol type IPv4.

--arp-ip-src [!] address[/mask]

The (R)ARP IP source address specification.

--arp-ip-dst [!] address[/mask]

The (R)ARP IP destination address specification.

--arp-mac-src [!] address[/mask]

The (R)ARP MAC source address specification.

--arp-mac-dst [!] address[/mask]

The (R)ARP MAC destination address specification.

[!] --arp-gratuitous

Checks for ARP gratuitous packets: checks equality of IPv4 source address and IPv4 destination address inside the ARP header.

### ip
Specify IPv4 fields. The protocol must be specified as IPv4.

--ip-source [!] address[/mask]

The source IP address. The flag --ip-src is an alias for this option.

--ip-destination [!] address[/mask]

The destination IP address. The flag --ip-dst is an alias for this option.

--ip-tos [!] tos

The IP type of service, in hexadecimal numbers. IPv4.

--ip-protocol [!] protocol

The IP protocol. The flag --ip-proto is an alias for this option.

--ip-source-port [!] port1[:port2]

The source port or port range for the IP protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip-protocol option must be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified, port1:65535 is used. The flag --ip-sport is an alias for this option.

--ip-destination-port [!] port1[:port2]

The destination port or port range for ip protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip-protocol option must be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified, port1:65535 is used. The flag --ip-dport is an alias for this option.

### ip6
Specify IPv6 fields. The protocol must be specified as IPv6.

--ip6-source [!] address[/mask]

The source IPv6 address. The flag --ip6-src is an alias for this option.

--ip6-destination [!] address[/mask]

The destination IPv6 address. The flag --ip6-dst is an alias for this option.

--ip6-tclass [!] tclass

The IPv6 traffic class, in hexadecimal numbers.

--ip6-protocol [!] protocol

The IP protocol. The flag --ip6-proto is an alias for this option.

--ip6-source-port [!] port1[:port2]

The source port or port range for the IPv6 protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip6-protocol option must be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified, port1:65535 is used. The flag --ip6-sport is an alias for this option.

--ip6-destination-port [!] port1[:port2]

The destination port or port range for IPv6 protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip6-protocol option must be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified, port1:65535 is used. The flag --ip6-dport is an alias for this option.

--ip6-icmp-type [!] {type[:type]/code[:code]|typename}

Specify ipv6-icmp type and code to match. Ranges for both type and code are supported. Type and code are separated by a slash. Valid numbers for type and range are 0 to 255. To match a single type including all valid codes, symbolic names can be used instead of numbers. The list of known type names is shown by the command

```
  ebtables --help ip6
```

This option is only valid for --ip6-prococol ipv6-icmp.

### limit
This module matches at a limited rate using a token bucket filter. A rule using this extension will match until this limit is reached. It can be used with the --log watcher to give limited logging, for example. Its use is the same as the limit match of iptables.

--limit [value]

Maximum average matching rate: specified as a number, with an optional /second, /minute, /hour, or /day suffix; the default is 3/hour.

--limit-burst [number]

Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5.

### mark_m
--mark [!] [value][/mask]

Matches frames with the given unsigned mark value. If a value and mask are specified, the logical AND of the mark value of the frame and the user-specified mask is taken before comparing it with the user-specified mark value. When only a mark value is specified, the packet only matches when the mark value of the frame equals the user-specified mark value. If only a mask is specified, the logical AND of the mark value of the frame and the user-specified mask is taken and the frame matches when the result of this logical AND is non-zero. Only specifying a mask is useful to match multiple mark values.

### pkttype
--pkttype-type [!] type

Matches on the Ethernet "class" of the frame, which is determined by the generic networking code. Possible values: broadcast (MAC destination is the broadcast address), multicast (MAC destination is a multicast address), host (MAC destination is the receiving network device), or otherhost (none of the above).

### stp
Specify stp BPDU (bridge protocol data unit) fields. The destination address (-d) must be specified as the bridge group address (BGA). For all options for which a range of values can be specified, it holds that if the lower bound is omitted (but the colon is not), then the lowest possible lower bound for that option is used, while if the upper bound is omitted (but the colon again is not), the highest possible upper bound for that option is used.

--stp-type [!] type

The BPDU type (0-255), recognized non-numerical types are config, denoting a configuration BPDU (=0), and tcn, denothing a topology change notification BPDU (=128).

--stp-flags [!] flag

The BPDU flag (0-255), recognized non-numerical flags are topology-change, denoting the topology change flag (=1), and topology-change-ack, denoting the topology change acknowledgement flag (=128).

--stp-root-prio [!] [prio][:prio]

The root priority (0-65535) range.

--stp-root-addr [!] [address][/mask]

The root mac address, see the option -s for more details.

--stp-root-cost [!] [cost][:cost]

The root path cost (0-4294967295) range.

--stp-sender-prio [!] [prio][:prio]

The BPDU's sender priority (0-65535) range.

--stp-sender-addr [!] [address][/mask]

The BPDU's sender mac address, see the option -s for more details.

--stp-port [!] [port][:port]

The port identifier (0-65535) range.

--stp-msg-age [!] [age][:age]

The message age timer (0-65535) range.

--stp-max-age [!] [age][:age]

The max age timer (0-65535) range.

--stp-hello-time [!] [time][:time]

The hello time timer (0-65535) range.

--stp-forward-delay [!] [delay][:delay]

The forward delay timer (0-65535) range.

### vlan
Specify 802.1Q Tag Control Information fields. The protocol must be specified as 802_1Q (0x8100).

--vlan-id [!] id

The VLAN identifier field (VID). Decimal number from 0 to 4095.

--vlan-prio [!] prio

The user priority field, a decimal number from 0 to 7. The VID should be set to 0 ("null VID") or unspecified (in the latter case the VID is deliberately set to 0).

--vlan-encap [!] type

The encapsulated Ethernet frame type/length. Specified as a hexadecimal number from 0x0000 to 0xFFFF or as a symbolic name from /etc/ethertypes.

### WATCHER EXTENSIONS
Watchers only look at frames passing by, they don't modify them nor decide to accept the frames or not. These watchers only see the frame if the frame matches the rule, and they see it before the target is executed.

### log
The log watcher writes descriptive data about a frame to the syslog.

--log

Log with the default loggin options: log-level= info, log-prefix="", no ip logging, no arp logging.

--log-level level

Defines the logging level. For the possible values, see ebtables -h log. The default level is info.

--log-prefix text

Defines the prefix text to be printed at the beginning of the line with the logging information.

--log-ip

Will log the ip information when a frame made by the ip protocol matches the rule. The default is no ip information logging.

--log-ip6

Will log the ipv6 information when a frame made by the ipv6 protocol matches the rule. The default is no ipv6 information logging.

--log-arp

Will log the (r)arp information when a frame made by the (r)arp protocols matches the rule. The default is no (r)arp information logging.

### nflog
The nflog watcher passes the packet to the loaded logging backend in order to log the packet. This is usually used in combination with nfnetlink_log as logging backend, which will multicast the packet through a netlink socket to the specified multicast group. One or more userspace processes may subscribe to the group to receive the packets.

--nflog

Log with the default logging options

--nflog-group nlgroup

The netlink group (1 - 2^32-1) to which packets are (only applicable for nfnetlink_log). The default value is 1.

--nflog-prefix prefix

A prefix string to include in the log message, up to 30 characters long, useful for distinguishing messages in the logs.

--nflog-range size

The number of bytes to be copied to userspace (only applicable for nfnetlink_log). nfnetlink_log instances may specify their own range, this option overrides it.

--nflog-threshold size

Number of packets to queue inside the kernel before sending them to userspace (only applicable for nfnetlink_log). Higher values result in less overhead per packet, but increase delay until the packets reach userspace. The default value is 1.

### ulog
The ulog watcher passes the packet to a userspace logging daemon using netlink multicast sockets. This differs from the log watcher in the sense that the complete packet is sent to userspace instead of a descriptive text and that netlink multicast sockets are used instead of the syslog. This watcher enables parsing of packets with userspace programs, the physical bridge in and out ports are also included in the netlink messages. The ulog watcher module accepts 2 parameters when the module is loaded into the kernel (e.g. with modprobe): nlbufsiz specifies how big the buffer for each netlink multicast group is. If you say nlbufsiz=8192, for example, up to eight kB of packets will get accumulated in the kernel until they are sent to userspace. It is not possible to allocate more than 128kB. Please also keep in mind that this buffer size is allocated for each nlgroup you are using, so the total kernel memory usage increases by that factor. The default is 4096. flushtimeout specifies after how many hundredths of a second the queue should be flushed, even if it is not full yet. The default is 10 (one tenth of a second).

--ulog

Use the default settings: ulog-prefix="", ulog-nlgroup=1, ulog-cprange=4096, ulog-qthreshold=1.

--ulog-prefix text

Defines the prefix included with the packets sent to userspace.

--ulog-nlgroup group

Defines which netlink group number to use (a number from 1 to 32). Make sure the netlink group numbers used for the iptables ULOG target differ from those used for the ebtables ulog watcher. The default group number is 1.

--ulog-cprange range

Defines the maximum copy range to userspace, for packets matching the rule. The default range is 0, which means the maximum copy range is given by nlbufsiz. A maximum copy range larger than 128*1024 is meaningless as the packets sent to userspace have an upper size limit of 128*1024.

--ulog-qthreshold threshold

Queue at most threshold number of packets before sending them to userspace with a netlink socket. Note that packets can be sent to userspace before the queue is full, this happens when the ulog kernel timer goes off (the frequency of this timer depends on flushtimeout).

### arpreply
The arpreply target can be used in the PREROUTING chain of the nat table. If this target sees an ARP request it will automatically reply with an ARP reply. The used MAC address for the reply can be specified. The protocol must be specified as ARP. When the ARP message is not an ARP request or when the ARP request isn't for an IP address on an Ethernet network, it is ignored by this target (CONTINUE). When the ARP request is malformed, it is dropped (DROP).

--arpreply-mac address

Specifies the MAC address to reply with: the Ethernet source MAC and the ARP payload source MAC will be filled in with this address.

--arpreply-target target

Specifies the standard target. After sending the ARP reply, the rule still has to give a standard target so ebtables knows what to do with the ARP request. The default target is DROP.

### dnat
The dnat target can only be used in the PREROUTING and OUTPUT chains of the nat table. It specifies that the destination MAC address has to be changed.

--to-destination address

Change the destination MAC address to the specified address. The flag --to-dst is an alias for this option.

--dnat-target target

Specifies the standard target. After doing the dnat, the rule still has to give a standard target so ebtables knows what to do with the dnated frame. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on the same frame. Making it DROP only makes sense in the BROUTING chain but using the redirect target is more logical there. RETURN is also allowed. Note that using RETURN in a base chain is not allowed (for obvious reasons).

### mark
The mark target can be used in every chain of every table. It is possible to use the marking of a frame/packet in both ebtables and iptables, if the bridge-nf code is compiled into the kernel. Both put the marking at the same place. This allows for a form of communication between ebtables and iptables.

--mark-set value

Mark the frame with the specified non-negative value.

--mark-or value

Or the frame with the specified non-negative value.

--mark-and value

And the frame with the specified non-negative value.

--mark-xor value

Xor the frame with the specified non-negative value.

--mark-target target

Specifies the standard target. After marking the frame, the rule still has to give a standard target so ebtables knows what to do. The default target is ACCEPT. Making it CONTINUE can let you do other things with the frame in subsequent rules of the chain.

### redirect
The redirect target will change the MAC target address to that of the bridge device the frame arrived on. This target can only be used in the PREROUTING chain of the nat table. The MAC address of the bridge is used as destination address."

--redirect-target target

Specifies the standard target. After doing the MAC redirect, the rule still has to give a standard target so ebtables knows what to do. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on the same frame. Making it DROP in the BROUTING chain will let the frames be routed. RETURN is also allowed. Note that using RETURN in a base chain is not allowed.

### snat
The snat target can only be used in the POSTROUTING chain of the nat table. It specifies that the source MAC address has to be changed.

--to-source address

Changes the source MAC address to the specified address. The flag --to-src is an alias for this option.

--snat-target target

Specifies the standard target. After doing the snat, the rule still has to give a standard target so ebtables knows what to do. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on the same frame. Making it DROP doesn't make sense, but you could do that too. RETURN is also allowed. Note that using RETURN in a base chain is not allowed.

--snat-arp

Also change the hardware source address inside the arp header if the packet is an arp message and the hardware address length in the arp header is 6 bytes.

## FILES
/etc/ethertypes

## MAILINGLISTS
See http://netfilter.org/mailinglists.html

## BUGS
The version of ebtables this man page ships with does not support the string match. Further, support for atomic-options (--atomic-file, --atomic-init, --atomic-save, --atomic-commit) has not been implemented, although ebtables-save and ebtables-restore might replace them entirely given the inherent atomicity of nftables. Finally, this list is probably not complete.

## SEE ALSO
xtables-nft(8), iptables(8), ip(8)

See https://wiki.nftables.org


xtables-monitor

title: xtables-monitor(8)

text:
# xtables-monitor(8)

## NAME
xtables-monitor — show changes to rule set and trace-events

## SYNOPSIS
xtables-monitor [-t] [-e] [-4||-6]

## DESCRIPTION
xtables-monitor is used to monitor changes to the ruleset or to show rule evaluation events for packets tagged using the TRACE target. xtables-monitor will run until the user aborts execution, typically by using CTRL-C.

## OPTIONS
-e, --event

Watch for updates to the rule set.

Updates include creation of new tables, chains and rules and the name of the program that caused the rule update.

-t, --trace

Watch for trace events generated by packets that have been tagged using the TRACE target.

-4

Restrict output to IPv4.

-6

Restrict output to IPv6.

## EXAMPLE OUTPUT
xtables-monitor --trace

1 TRACE: 2 fc475095 raw:PREROUTING:rule:0x3:CONTINUE -4 -t raw -A PREROUTING -p icmp -j TRACE

2 PACKET: 0 fc475095 IN=lo LL=0x304 0000000000000000000000000800 SRC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x0 TTL=64 ID=38349DF

3 TRACE: 2 fc475095 raw:PREROUTING:return:

4 TRACE: 2 fc475095 raw:PREROUTING:policy:ACCEPT

5 TRACE: 2 fc475095 filter:INPUT:return:

6 TRACE: 2 fc475095 filter:INPUT:policy:DROP

7 TRACE: 2 0df9d3d8 raw:PREROUTING:rule:0x3:CONTINUE -4 -t raw -A PREROUTING -p icmp -j TRACE

The first line shows a packet entering rule set evaluation. The protocol number is shown (AF_INET in this case), then a packet identifier number that allows to correlate messages coming from rule set evaluation of this packet. After this, the rule that was matched by the packet is shown. This is the TRACE rule that turns on tracing events for this packet.

The second line dumps information about the packet. Incoming interface and packet headers such as source and destination addresses are shown.

The third line shows that the packet completed traversal of the raw table PREROUTING chain, and is returning, followed by use of the chain policy to make accept/drop decision (the example shows accept being applied). The fifth line shows that the packet leaves the filter INPUT chain, i.e., no rules in the filter table's INPUT chain matched the packet. It then got DROPPED by the policy of the INPUT table, as shown by line six. The last line shows another packet arriving -- the packet id is different.

When using the TRACE target, it is usually a good idea to only select packets that are relevant, for example via

```
iptables -t raw -A PREROUTING -p tcp --dport 80 --syn -m limit --limit 1/s -j TRACE
```

xtables-monitor --event

1 EVENT: nft: NEW table: table filter ip flags 0 use 4 handle 444

2 EVENT: # nft: ip filter INPUT use 2 type filter hook input prio 0 policy drop packets 0 bytes 0

3 EVENT: # nft: ip filter FORWARD use 0 type filter hook forward prio 0 policy accept packets 0 bytes 0

4 EVENT: # nft: ip filter OUTPUT use 0 type filter hook output prio 0 policy accept packets 0 bytes 0

5 EVENT: -4 -t filter -N TCP

6 EVENT: -4 -t filter -A TCP -s 192.168.0.0/16 -p tcp -m tcp --dport 22 -j ACCEPT

7 EVENT: -4 -t filter -A TCP -p tcp -m multiport --dports 80,443 -j ACCEPT

8 EVENT: -4 -t filter -A INPUT -p tcp -j TCP

9 EVENT: -4 -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

10 NEWGEN: GENID=13904 PID=25167 NAME=iptables-nftables-restore

This example shows event monitoring. Line one shows creation of a table (filter in this case), followed by three base hooks INPUT, FORWARD and OUTPUT. The iptables-nftables tools all create tables and base chains automatically when needed, so this is expected when a table was not yet initialized or when it is re-created from scratch by iptables-nftables-restore. Line five shows a new user-defined chain (TCP) being added, followed by addition a few rules. the last line shows that a new ruleset generation has become active, i.e., the rule set changes are now active. This also lists the process id and the program name.

## LIMITATIONS
xtables-monitor only works with rules added using iptables-nftables, rules added using iptables-legacy cannot be monitored.

## BUGS
Should be reported or by sending email to netfilter-devel@vger.kernel.org or by filing a report on https://bugzilla.netfilter.org/.

## SEE ALSO
iptables(8), xtables(8), nft(8)


xtables-nft

title: xtables-nft(8)

summary: iptables using nftables kernel api

text:
# xtables-nft(8)

## NAME
xtables-nft — iptables using nftables kernel api

## DESCRIPTION
xtables-nft are versions of iptables that use the nftables API. This is a set of tools to help the system administrator migrate the ruleset from iptables(8), ip6tables(8), arptables(8), and ebtables(8) to nftables(8).

The xtables-nft set is composed of several commands:

•

iptables-nft

•

iptables-nft-save

•

iptables-nft-restore

•

ip6tables-nft

•

ip6tables-nft-save

•

ip6tables-nft-restore

•

arptables-nft

•

ebtables-nft These tools use the libxtables framework extensions and hook to the nf_tables kernel subsystem using the nft_compat module.

## USAGE
The xtables-nft tools allow you to manage the nf_tables backend using the native syntax of iptables(8), ip6tables(8), arptables(8), and ebtables(8).

You should use the xtables-nft tools exactly the same way as you would use the corresponding original tools.

Adding a rule will result in that rule being added to the nf_tables kernel subsystem instead. Listing the ruleset will use the nf_tables backend as well.

When these tools were designed, the main idea was to replace each legacy binary with a symlink to the xtables-nft program, for example:

```
	/sbin/iptables -> /usr/sbin/iptables-nft-multi
	/sbin/ip6tables -> /usr/sbin/ip6tables-nft-multi
	/sbin/arptables -> /usr/sbin/arptables-nft-multi
	/sbin/ebtables -> /usr/sbin/ebtables-nft-multi
```

The iptables version string will indicate whether the legacy API (get/setsockopt) or the new nf_tables api is used:

```
	iptables -V
	iptables v1.7 (nf_tables)
```

## DIFFERENCES TO LEGACY IPTABLES
Because the xtables-nft tools use the nf_tables kernel API, rule additions and deletions are always atomic. Unlike iptables-legacy, iptables-nft -A .. will NOT need to retrieve the current ruleset from the kernel, change it, and re-load the altered ruleset. Instead, iptables-nft will tell the kernel to add one rule. For this reason, the iptables-legacy --wait option is a no-op in iptables-nft.

Use of the xtables-nft tools allow monitoring ruleset changes using the xtables-monitor(8) command.

When using -j TRACE to debug packet traversal to the ruleset, note that you will need to use xtables-monitor(8) in --trace mode to obtain monitoring trace events.

## EXAMPLES
One basic example is creating the skeleton ruleset in nf_tables from the xtables-nft tools, in a fresh machine:

```
	root@machine:~# iptables-nft -L
	[...]
	root@machine:~# ip6tables-nft -L
	[...]
	root@machine:~# arptables-nft -L
	[...]
	root@machine:~# ebtables-nft -L
	[...]
	root@machine:~# nft list ruleset
	table ip filter {
		chain INPUT {
			type filter hook input priority 0; policy accept;
		}
		chain FORWARD {
			type filter hook forward priority 0; policy accept;
		}
		chain OUTPUT {
			type filter hook output priority 0; policy accept;
		}
	}
	table ip6 filter {
		chain INPUT {
			type filter hook input priority 0; policy accept;
		}
		chain FORWARD {
			type filter hook forward priority 0; policy accept;
		}
		chain OUTPUT {
			type filter hook output priority 0; policy accept;
		}
	}
	table bridge filter {
		chain INPUT {
			type filter hook input priority -200; policy accept;
		}
		chain FORWARD {
			type filter hook forward priority -200; policy accept;
		}
		chain OUTPUT {
			type filter hook output priority -200; policy accept;
		}
	}
	table arp filter {
		chain INPUT {
			type filter hook input priority 0; policy accept;
		}
		chain FORWARD {
			type filter hook forward priority 0; policy accept;
		}
		chain OUTPUT {
			type filter hook output priority 0; policy accept;
		}
	}
```

(please note that in fresh machines, listing the ruleset for the first time results in all tables an chain being created).

To migrate your complete filter ruleset, in the case of iptables(8), you would use:

```
	root@machine:~# iptables-legacy-save > myruleset # reads from x_tables
	root@machine:~# iptables-nft-restore myruleset   # writes to nf_tables
```

or

```
	root@machine:~# iptables-legacy-save | iptables-translate-restore | less
```

to see how rules would look like in the nft nft(8) syntax.

## LIMITATIONS
You should use Linux kernel >= 4.17.

The CLUSTERIP target is not supported.

To get up-to-date information about this, please head to http://wiki.nftables.org/.

## SEE ALSO
nft(8), xtables-translate(8), xtables-monitor(8)

## AUTHORS
The nftables framework is written by the Netfilter project (https://www.netfilter.org).

This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> for the Debian project, but may be used by others.

This documentation is free/libre under the terms of the GPLv2+.


xtables-translate

title: xtables-translate(8)

text:
# xtables-translate(8)

## NAME
iptables-translate — translation tool to migrate from iptables to nftables

ip6tables-translate — translation tool to migrate from ip6tables to nftables

ebtables-translate — translation tool to migrate from ebtables to nftables

## DESCRIPTION
There is a set of tools to help the system administrator translate a given ruleset from iptables(8), ip6tables(8) and ebtables(8) to nftables(8).

The available commands are:

•

iptables-translate

•

iptables-restore-translate

•

ip6tables-translate

•

ip6tables-restore-translate

•

ebtables-translate

## USAGE
They take as input the original iptables(8)/ip6tables(8)/ebtables(8) syntax and output the native nftables(8) syntax.

The iptables-restore-translate tool reads a ruleset in the syntax produced by iptables-save(8). Likewise, the ip6tables-restore-translate tool reads one produced by ip6tables-save(8). No ruleset modifications occur, these tools are text converters only.

The iptables-translate reads a command line as if it was entered to iptables(8), and ip6tables-translate reads a command like as if it was entered to ip6tables(8).

## EXAMPLES
Basic operation examples.

Single command translation:

```
root@machine:~# iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
root@machine:~# ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept
```

Whole ruleset translation:

```
root@machine:~# iptables-save > save.txt
root@machine:~# cat save.txt
# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
*filter
:INPUT ACCEPT [5166:1752111]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5058:628693]
-A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:26:40 2016
root@machine:~# iptables-restore-translate -f save.txt
# Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; }
add chain ip filter FORWARD { type filter hook forward priority 0; }
add chain ip filter OUTPUT { type filter hook output priority 0; }
add rule ip filter FORWARD tcp dport 22 ct state new counter accept
root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
root@machine:~# nft -f ruleset.nft
root@machine:~# nft list ruleset
table ip filter {
	chain INPUT {
		type filter hook input priority 0; policy accept;
	}
	chain FORWARD {
		type filter hook forward priority 0; policy accept;
		tcp dport ssh ct state new counter packets 0 bytes 0 accept
	}
	chain OUTPUT {
		type filter hook output priority 0; policy accept;
	}
}
```

## LIMITATIONS
Some (few) extensions may be not supported (or fully-supported) for whatever reason (for example, they were considered obsolete, or we didn't have the time to work on them).

There is no translation available for arptables(8).

To get up-to-date information about this, please head to https://wiki.nftables.org/.

## SEE ALSO
nft(8), iptables(8)

## AUTHORS
The nftables framework is written by the Netfilter project (https://www.netfilter.org).

This manual page was written by Arturo Borrero Gonzalez <arturo@netfilter.org>.

This documentation is free/libre under the terms of the GPLv2+.


iptraf-ng

package: iptraf-ng

title: iptraf-ng(8)

summary: Interactive Colorful IP LAN Monitor

text:
# iptraf-ng(8)

## NAME
iptraf - Interactive Colorful IP LAN Monitor

## SYNOPSIS
iptraf-ng { [ -f ] [ { -i iface | -g | -d iface | -s iface | -z iface | -l iface } [ -t timeout ] [ -B [ -L logfile ] ] ] | [ -h ] }

## DESCRIPTION
iptraf-ng is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others.

If the iptraf-ng command is issued without any command-line options, the program comes up in interactive mode, with the various facilities accessed through the main menu.

## OPTIONS
These options can also be supplied to the command:

-i iface

immediately start the IP traffic monitor on the specified interface, or all interfaces if "-i all" is specified

-g

immediately start the general interface statistics

-d iface

allows you to immediately start the detailed on the indicated interface (iface)

-s iface

allows you to immediately monitor TCP and UDP traffic on the specified interface (iface)

-z iface

shows packet counts by size on the specified interface

-l iface

start the LAN station monitor on the specified interface, or all LAN interfaces if "-l all" is specified

-t timeout

tells IPTraf-ng to run the specified facility for only timeout minutes. This option is used only with one of the above parameters.

-B

redirect standard output to /dev/null, closes standard input, and forks the program into the background. Can be used only with one of the facility invocation parameters above. Send the backgrounded process a USR2 signal to terminate.

-L logfile

allows you to specify an alternate log file name. The default log file name is based on either the interface selected (detailed interface statistics, TCP/UDP service statistics, packet size breakdown), or the instance of the facility (IP traffic monitor, LAN station monitor). If a path is not specified, the log file is placed in /var/log/iptraf-ng

-f

clears all locks and counters, causing this instance of IPTraf-ng to think it's the first one running. This should only be used to recover from an abnormal termination or system crash.

-h

shows a command summary

## SIGNALS

SIGUSR1 - rotates log files while program is running

SIGUSR2 - terminates an IPTraf-ng process running in the background.

## FILES

/var/log/iptraf-ng/*.log - log file

/var/lib/iptraf-ng/* - important IPTraf-ng data files

## SEE ALSO

Documentation/* - complete documentation written by the author

## AUTHOR
Gerard Paul Java (riker@mozcom.com)

## MANUAL AUTHOR
Frederic Peters (fpeters@debian.org), using iptraf-ng -h General manual page modifications by Gerard Paul Java (riker@mozcom.com), Phil Cameron (pcameron@redhat.com)


iptstate

package: iptstate

title: iptstate(8)

text:
# iptstate(8)

## NAME
iptstate - A top-like display of IP Tables state table entries

## SYNOPSIS
iptstate [<options>]

## DESCRIPTION
iptstate displays information held in the IP Tables state table in real-time in a top-like format. Output can be sorted by any field, or any field reversed. Users can choose to have the output only print once and exit, rather than the top-like system. Refresh rate is configurable, IPs can be resolved to names, output can be formatted, the display can be filtered, and color coding are among some of the many features.

## COMMAND-LINE OPTIONS
-c, --no-color

Toggle color-code by protocol

-C, --counters

Toggle display of bytes/packets counters

-d, --dst-filter IP[/NETMASK]

Only show states with a destination of IP and with optional NETMASK.

Note, that this must be an IP, hostname matching is not yet supported.

-D --dstpt-filter port

Only show states with a destination port of port

-h, --help

Show help message

-i, --invert-filters

Invert filters to display non-matching results

-l, --lookup

Show hostnames instead of IP addresses. Enabling this will also enable -L to prevent an ever-growing number of DNS requests.

-m, --mark-truncated

Mark truncated hostnames with a '+'

-o, --no-dynamic

Toggle dynamic formatting

-L, --no-dns

Skip outgoing DNS lookup states

-f, --no-loopback

Filter states on loopback

-p, --no-scroll

No scrolling (don't use a "pad"). See SCROLLING AND PADS for more information.

-r, --reverse

Reverse sort order

-R, --rate seconds

Refresh rate, followed by rate in seconds. Note that this is for statetop mode, and not applicable for single-run mode (--single).

-1, --single

Single run (no curses)

-b, --sort column

This determines what column to sort by. Options:

S Source Port

d Destination IP (or Name)

D Destination Port

p Protocol

s State

t TTL

b Bytes

P Packets

To sort by Source IP (or Name), don't use -b. Sorting by bytes/packets is only available for kernels that support it, and only when compiled against libnetfilter_conntrack (the default).

-s, --src-filter IP[/NETMASK]

Only show states with a source of IP and with optional NETMASK.

Note, that this must be an IP, hostname matching is not yet supported.

-S, --srcpt-filter port

Only show states with a source port of port

-t, --totals

Toggle display of totals

## INTERACTIVE OPTIONS
As of version 2.0, all command-line options are now available interactively using the same key as the short-option. For example, --sort is also -b, so while iptstate is running, hitting b will change the sorting to the next column. Similarly, t toggles the display of totals, and so on.

There are also extra interactive options: B - change sorting to previous column (opposite of b); q - quit; and x - delete the currently highlighted state from the netfilter conntrack table.

Additionally, the following keys are used to navigate within iptstate:

Up or j - Move up one line

Down or k - Move down one line

Left or h - Move left one column

Right or l - Move right one column

PageUp or ^u - Move up one page

PageDown or ^d - Move down one page

Home - Go to the top

End - Go to the end

In many cases, iptstate needs to prompt you in order to change something. For example, if you want to set or change the source-ip filter, when you hit s, iptstate will pop up a prompt at the top of the window to ask you what you want to set it to.

Note that like many UNIX applications, ctrl-G will tell iptstate "nevermind" - it'll remove the prompt and forget you ever hit s.

In most cases, a blank response means "clear" - clear the source IP filter, for example.

At anytime while iptstate is running, you can hit h to get to the interactive help which will display all the current settings to you as well give you a list of all interactive commands available.

While running, space will immediately update the display. Iptstate should gracefully handle all window resizes, but if it doesn't, you can force it to re-calculate and re-draw the screen with a ctrl-L.

Note that hitting l to enable hostname resolution while in interactive mode will also enable L to skip all DNS entries (to prevent an ever-growing number of DNS requests).

## SCROLLING AND PADS
For almost any user, there is no reason to turn off scrolling. The ability to turn this off - and especially the ability to toggle this interactively - is done more for theoretical completeness than anything else.

But, nonetheless, here are the details. Typically in a curses application you create a "window." Windows don't scroll, however. They are, at most, the size of your terminal. Windows provide double-buffering to make refreshing as fast and seemless as possible. However, to enable scrolling, one has to use "pads" instead of windows. Pads can be bigger than the current terminal. Then all necessary data is written to the pad, and "scrolling" becomes a function of just showing the right part of that pad on the screen.

However, pads do not have the double-buffering feature that windows have. Thus, there _might_ be some case where for some user using some very strange machine, having scrolling enabled could cause poor refreshing. Given the nature of the way iptstate uses the screen though, I find this highly unlikely. In addition, the scrolling method uses a little more memory. However, iptstate is not a memory intensive application, so this shouldn't be a problem even on low-memory systems.

Nonetheless, if this does negatively affect you, the option to turn it off is there.

## EXIT STATUS
Anything other than 0 indicates and error. A list of current exit statuses are below:

0

Success

1

Bad command-line arguments

2

Error communicating with the netfilter subsystem.

3

Terminal too narrow

## BUGS
We don't support filtering on resolved names. IPv6 support is new and the dynamic formatting doesn't yet always handle IPv6 addresses as well as it should.

## BUG REPORTS
All bugs should be reported to Phil Dibowitz <phil AT ipom DOT com>. Please see the README and BUGS for more information on bug reports. Please read the WISHLIST before sending in features you hope to see.

## NOTES
iptstate does a lot of work to try to fit everything on the screen in an easy-to-read way. However, in some cases, hostnames may need to be truncated (in lookup mode). Similarly, IPv6 addresses may need to be truncated. The truncation of names happens from the right for source because you most likely know your own domain name, and from the left for destination because knowing your users are connection to "mail.a." doesn't help much. However, for addresses, this is reversed.

iptstate does not automatically handle window-resizes while in the interactive help screen. If you do resize while in this window, you should return to the main window, hit ctrl-L to re-calculate and re-draw the screen, and then, if you choose, return to the interactive help.

iptstate currently uses libnetfilter_conntrack to access the netfilter connection state table. However, older versions read out of /proc/net/ip_conntrack, and the current version can still be compiled to do this. This deprecated method can be racy on SMP systems, and can hurt performance on very heavily loaded firewalls. This deprecated method should be avoided - support will be removed in future versions.

## SEE ALSO
iptables(8)

## AUTHOR
iptstate was written by Phil Dibowitz <phil AT ipom DOT com>

http://www.phildev.net/iptstate/


arping

package: iputils

title: arping(8)

summary: send ARP REQUEST to a neighbour host

text:
# arping(8)

## NAME
arping - send ARP REQUEST to a neighbour host

## SYNOPSIS
arping [-AbDfhqUV] [-c count] [-w deadline] [-i interval] [-s source] [-I interface] {destination}

## DESCRIPTION
Ping destination on device interface by ARP packets, using source address source.

arping supports IPv4 addresses only. For IPv6, see ndisc6(8).

## OPTIONS
-A

The same as -U, but ARP REPLY packets used instead of ARP REQUEST.

-b

Send only MAC level broadcasts. Normally arping starts from sending broadcast, and switch to unicast after reply received.

-c count

Stop after sending count ARP REQUEST packets. With deadline option, instead wait for count ARP REPLY packets, or until the timeout expires.

-D

Duplicate address detection mode (DAD). See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received.

-f

Finish after the first reply confirming that target is alive.

-I interface

Name of network device where to send ARP REQUEST packets.

-h

Print help page and exit.

-q

Quiet output. Nothing is displayed.

-s source

IP source address to use in ARP packets. If this option is absent, source address is:

• In DAD mode (with option -D) set to 0.0.0.0.

• In Unsolicited ARP mode (with options -U or -A) set to destination.

• Otherwise, it is calculated from routing tables.

-U

Unsolicited ARP mode to update neighbours' ARP caches. No replies are expected.

-V

Print version of the program and exit.

-w deadline

Specify a timeout, in seconds, before arping exits regardless of how many packets have been sent or received. If any replies are received, exit with status 0, otherwise status 1. When combined with the count option, exit with status 0 if count replies are received before the deadline expiration, otherwise status 1.

-i interval

Specify an interval, in seconds, between packets.

## SEE ALSO
ndisc6(8), ping(1), clockdiff(8), tracepath(1).

## AUTHOR
arping was written by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>.

## SECURITY
arping requires CAP_NET_RAW capability to be executed. It is not recommended to be used as set-uid root, because it allows user to modify ARP caches of neighbour hosts.

## AVAILABILITY
arping is part of iputils package.


clockdiff

title: clockdiff(8)

summary: measure clock difference between hosts

text:
# clockdiff(8)

## NAME
clockdiff - measure clock difference between hosts

## SYNOPSIS
clockdiff [-o] [-o1] [--time-format ctime iso] [-V] {destination}

## DESCRIPTION
clockdiff Measures clock difference between us and destination with 1 msec resolution using ICMP TIMESTAMP [2] packets or, optionally, IP TIMESTAMP option [3] added to ICMP ECHO. [1]

## OPTIONS
-o

Use IP TIMESTAMP with ICMP ECHO instead of ICMP TIMESTAMP messages. It is useful with some destinations, which do not support ICMP TIMESTAMP (f.e. Solaris <2.4).

-o1

Slightly different form of -o, namely it uses three-term IP TIMESTAMP with prespecified hop addresses instead of four term one. What flavor works better depends on target host. Particularly, -o is better for Linux.

-T, --time-format ctime iso

Print time stamp in output either ISO-8601 format or classical ctime format. The ctime format is default. The ISO time stamp includes timezone, and is easier to parse.

-I

Alias of --time-format iso option and argument.

-h, --help

Print help and exit.

-V, --version

Print version and exit.

## WARNINGS
• Some nodes (Cisco) use non-standard timestamps, which is allowed by RFC, but makes timestamps mostly useless.

• Some nodes generate messed timestamps (Solaris>2.4), when run xntpd. Seems, its IP stack uses a corrupted clock source, which is synchronized to time-of-day clock periodically and jumps randomly making timestamps mostly useless. Good news is that you can use NTP in this case, which is even better.

• clockdiff shows difference in time modulo 24 days.

## SEE ALSO
ping(1), arping(8), tracepath(1).

## REFERENCES
[1] ICMP ECHO, RFC0792, page 14.

[2] ICMP TIMESTAMP, RFC0792, page 16.

[3] IP TIMESTAMP option, RFC0791, 3.1, page 16.

## AUTHOR
clockdiff was compiled by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>. It was based on code borrowed from BSD timed daemon.

## SECURITY
clockdiff requires CAP_NET_RAW and CAP_SYS_NICE capabilities to be executed. It is safe to be used as set-uid root.

## AVAILABILITY
clockdiff is part of iputils package.