When writing an iptables save file by hand, how does one calculate the packet-counter and byte-counter values?

Question

I am attempting to write a 22MB iptables rule-set file, the very kind that is generated with the iptables-save command, except endlessly long. Understandably, this takes a prohibitive amount of time. Take this miniature example.

*filter
:INPUT ACCEPT [64:4692]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [72:28512]
-A INPUT -p tcp -m tcp --sport 9000:9004 -m iprange --src-range 127.0.0.1-127.0.0.1 -j DROP
COMMIT

Following (INPUT|OUTPUT|FORWARD) ACCEPT, there appear value ranges.

:< chain-name > < chain-policy > [< packet-counter >:< byte-counter >]

These seem dependent on something already stored within iptables on the use of iptables-save, but, since loading the rules into iptables is the problem in the first place, I am unsure how to acquire these values, that I may enter them by hand (by vim, rather), into the final rule-set file.

How might one go about calculating these values? Is it possible without running another iptables command?

Answer 1

Unless you are using the counters in one of your rules, or need the counters for some other purpose (billing etc), I would just omit them as follows:

*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --sport 9000:9004 -m iprange --src-range 127.0.0.1-127.0.0.1 -j DROP
COMMIT

It is possible to see the current counter values using the iptables --list command.

iptables -L -v -x

Note that the counters change as packets are passed down the rules chains, so as soon as you read the counters they may be changed by an incoming or outgoing packet.