Re: [LARTC] realtime trafic monitor

[NightInTheCity@softhome.net]

hmmm ... i don't really know if i should classify this as
real time, but i'll go ahead.
depends how much of your real time are u going to spend on it.

background:
following multiple papers@web first i started parsing whetever tool's
output came in my hand e.g. ifconfig and so on, than i upgraded to
ipchains/later on iptables accounting. (e.g create 2 chains, jump dst /
src from ips to be monitored, querry the chain). still no
satisfaction. than iptraf and friends. [and i even parsed human
readable output to rrdtool's rrds.] still no satisfaction. this is not
realtime. (or realtime = very complex for me?)

following cisco's NetFlow implementations @ linux i came across
multiple tools that would do similar things to ip flow export in cisco
routers. none until couple of months guaranteed my satisfaction. i
mean softflowd (disliked promiscuous mode), fprobe/ulogd-probe (too
harsh combination of ulogd targets and network traffic sampling) and
so on. even ntop.

so i would recommend strongly using <<ipcad>> daemon to implement network
traffic sampling and NetFlow export; flow-tools to capture NetFlow
dataflow and analyze. and this is real time by all means traffic
monitoring.not just 100kbps on this target, but 10 packets there, 200
bits there, when, where, all beeing agregated and transformed to feed one's joy to
handle numbers. lots.

have phun.
NightInTheCity

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/