[LARTC] 'routing connection'

[LARTC] 'routing connection'

[Ming-Ching Tiew]

Given a running router/firewall machine, there may be
many 'routing connections' going on at same time.
I am stucked with a basic question unanswered, how do
I know which are the applications using the heaviest
routing traffic ? 

I could do a trial and error by using 'iptables', say
using a port range, but there are still too many
possibilities.

I thought 'netstat' could solve my problem, apparently
not. It seems netstat only shows the connection
originating and terminating in the machine and not
'routing connections'. I am looking for a simple and
light weight program which can meet this requirement.
Any recommendation ?




__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - establish your business online
http://webhosting.yahoo.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] 'routing connection'

[Tomas Bonnedahl]

iptraf could perhaps solve your problems, i donno the url to it but you should find it via google.


-tomas

On Fri, Mar 14, 2003 at 04:48:26AM -0800, Ming-Ching Tiew wrote:
> 
> Given a running router/firewall machine, there may be
> many 'routing connections' going on at same time.
> I am stucked with a basic question unanswered, how do
> I know which are the applications using the heaviest
> routing traffic ? 
> 
> I could do a trial and error by using 'iptables', say
> using a port range, but there are still too many
> possibilities.
> 
> I thought 'netstat' could solve my problem, apparently
> not. It seems netstat only shows the connection
> originating and terminating in the machine and not
> 'routing connections'. I am looking for a simple and
> light weight program which can meet this requirement.
> Any recommendation ?
> 
> 
> 
> 
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Web Hosting - establish your business online
> http://webhosting.yahoo.com
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> 
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] 'routing connection'

[Martin A. Brown]

Hi there Ming-Ching,

 : Given a running router/firewall machine, there may be many 'routing
 : connections' going on at same time. I am stucked with a basic question
 : unanswered, how do I know which are the applications using the heaviest
 : routing traffic ?

Try iptraf or ntop.

  http://iptraf.seul.org/           # -- quick/easy; visual; curses
  http://www.ntop.org/ntop.html     # -- can keep historical data

See also the following thread:

  http://mailman.ds9a.nl/pipermail/lartc/2003q1/007051.html

 : I could do a trial and error by using 'iptables', say
 : using a port range, but there are still too many
 : possibilities.

 : I thought 'netstat' could solve my problem, apparently
 : not. It seems netstat only shows the connection
 : originating and terminating in the machine and not
 : 'routing connections'. I am looking for a simple and
 : light weight program which can meet this requirement.
 : Any recommendation ?

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] 'routing connection'

[Ming-Ching Tiew]

Thanks for the info. Haven't checked 'ntop' but iptraf
does not mean my requirement because I am looking
for a simple program ( low foot-print !!) which I
could
script it and display the result remotely. :-) 

Rgds.

--- "Martin A. Brown" <mabrown-lartc@securepipe.com> 
> 
> Try iptraf or ntop.
> 
>   http://iptraf.seul.org/           # -- quick/easy;
> visual; curses
>   http://www.ntop.org/ntop.html     # -- can keep
> historical data
> 


__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - establish your business online
http://webhosting.yahoo.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] 'routing connection'

[Paul Evans]

On March 14, 2003 15:57 pm, Ming-Ching Tiew wrote:
> Thanks for the info. Haven't checked 'ntop' but iptraf
> does not mean my requirement because I am looking
> for a simple program ( low foot-print !!) which I
> could
> script it and display the result remotely. :-)

You can use iptraf without the ncurses interface. The -B switch throws it in 
the background, the -t switch sets the interval to watch and you can choose 
which interface to monitor and in what way with other switches. Its default 
for logging is /var/log/iptraff/

I've never put it on a cron, but I often nohup it and log out.

-- 
Regards, Paul Evans


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/