Por que o iptables está carregado e ativo, nenhum número de pid é exibido em 'ps aux'?

Question

Listar status do iptables.

[root@myvps ~]# systemctl status iptables
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: active (exited) since Sun 2017-11-12 02:49:39 EST; 38s ago
  Process: 13929 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
  Process: 13987 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
 Main PID: 13987 (code=exited, status=0/SUCCESS)

Nov 12 02:49:39 myvps systemd[1]: Starting IPv4 firewall with iptables...
Nov 12 02:49:39 myvps iptables.init[13987]: iptables: Applying firewall rules: [  OK  ]
Nov 12 02:49:39 myvps systemd[1]: Started IPv4 firewall with iptables.

Listar todos os processos.

[root@myvps ~]# ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  40912  2920 ?        Ss   Nov11   0:02 /usr/lib/systemd/systemd --system --deserialize 19
root         2  0.0  0.0      0     0 ?        S    Nov11   0:00 [kthreadd/27111]
root         3  0.0  0.0      0     0 ?        S    Nov11   0:00 [khelper/27111]
root        63  0.0  0.4  77728  8532 ?        Ss   Nov11   0:14 /usr/lib/systemd/systemd-journald
dbus       113  0.0  0.0  26672  1612 ?        Ss   Nov11   0:00 /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
root       118  0.0  0.0  26344  1524 ?        Ss   Nov11   0:00 /usr/lib/systemd/systemd-logind
root       128  0.0  0.0   6400   768 tty2     Ss+  Nov11   0:00 /sbin/agetty --noclear tty2 linux
root       129  0.0  0.0   6400   764 tty1     Ss+  Nov11   0:00 /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt220
root       498  0.0  0.0  41332  1268 ?        Ss   Nov11   0:00 /usr/lib/systemd/systemd-udevd
root       627  0.0  0.1  82504  3040 ?        Ss   Nov11   0:02 /usr/sbin/sshd -D
root     12954  0.0  0.3 141232  7320 ?        Ss   00:23   0:00 sshd: root@pts/0
root     12958  0.0  0.0 115328  1996 pts/0    Ss   00:23   0:00 -bash
root     12993  0.0  0.1 248992  3660 ?        Ssl  00:26   0:00 /usr/sbin/rsyslogd -n
root     14002  0.0  0.1  81656  3720 ?        Ss   02:50   0:00 sshd: [accepted]
sshd     14003  0.0  0.0  81656  2088 ?        S    02:50   0:00 sshd: [net]
root     14005  0.0  0.0 150984  1820 pts/0    R+   02:50   0:00 ps aux

Por que o iptables é carregado e ativo, nenhum número de pid é exibido em ps aux ?

    

Answer 1

iptables é um módulo do kernel, não um processo. Se eles são compilados como módulos carregáveis para o seu kernel, você pode usar lsmod para ver as várias partes:

$ lsmod | grep tabl
ip6table_filter        16384  0
ip6_tables             20480  1 ip6table_filter
iptable_mangle         16384  1
iptable_filter         16384  0
ip_tables              20480  2 iptable_mangle,iptable_filter
x_tables               20480  8 iptable_mangle,ip_tables,iptable_filter,xt_length,xt_mark,xt_tcpudp,ip6table_filter,ip6_tables