I would like to be able to count the number of bytes going to a given MAC address using iptables
or ebtables
or some other linux utility. I have tried looking at the byte counts in ebtables
but they are always 0, am I doing something wrong here?
IPTables supports traffic accounting. You should just be able to setup an IPtables rule matching the mac address you are interested in, then look at it's counters to see what kind of traffic it's pushing. Note that you can't use this to look at traffic for other machines on the LAN, it will only be for traffic to or from the machine it's running on.
I ended up solving this by getting the IP address associated with each MAC address from
arp
and adding an accounting rule iniptables
to count download traffic for that IP address.