On 02/25/2010 02:11 PM, Kan-I Jyo wrote:
> Dear list,
> 
> This might be too fundamental to answer, but I would like to know
> when will the 'dropped' value in the output of /sbin/ifconfig be counted up.
> 
> I have tried setting up a firewall using iptables with a very simple rule like
> the following:
> 
>   <samle>
>     # iptables -A INPUT -p tcp --dport 80 -j DROP
> 
> When trying to connect from the other host through tcp port 80, there
> was no response, which is expected.
> 
> However, the 'dropped' value was note added up even the packet is dropped.

Well, you're talking about two different things:
the dropped value in ifconfig output is related to Ethernet packet which
would be dropped by hardware.
The target DROP of iptables tells to the kernel to drop the packet at
software level.

If you want to see the dropped packet statistics on software level (ie
iptables), run iptables -v -L .

> Any comment would be greatly appreciated.

-- 
      Xavier Parizet
YaGB :   http://gentooist.com
GPG  :    C7DC B10E FC21 63BE
B453 D239 F6E6 DF65 1569 91BF