[LARTC] Monitoring traffic

[LARTC] Monitoring traffic

[RoMaN SoFt / LLFB]

 Hi.

 I'm going to setup policy routing and traffic shaping. Before that I
need to do some kind of study about our traffic to determine the best
way of distribute our bandwidth. For that reason I'd like some tool
that could retrieve this information:
- traffic based on app layer protocol (for instance, http, ftp, pop3;
or basing on different destination ports: 80, 21, 110).
- the measurements should be statistics, I mean, I could examine
traffic from 9h to 14h and that program should give traffic per hour,
etc.
- differentiate inbound / outbound traffic

 The idea is that I could determine for example if my outbound
bandwidth is abused for one or another protocol, etc...

 Which tool would you use? Thanks in advance.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    ** RoMaN SoFt / LLFB **  
       roman@madrid.com
   http://pagina.de/romansoft
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/

Re: [LARTC] Monitoring traffic

[bert hubert]

On Sat, Sep 22, 2001 at 04:41:57PM +0200, RoMaN SoFt / LLFB wrote:
> 
>  Hi.
> 
>  I'm going to setup policy routing and traffic shaping. Before that I
> need to do some kind of study about our traffic to determine the best
> way of distribute our bandwidth. For that reason I'd like some tool
> that could retrieve this information:
> - traffic based on app layer protocol (for instance, http, ftp, pop3;
> or basing on different destination ports: 80, 21, 110).
> - the measurements should be statistics, I mean, I could examine
> traffic from 9h to 14h and that program should give traffic per hour,
> etc.
> - differentiate inbound / outbound traffic

Tricky. For instantaneous measurements, I use iptraf. Then there is ipac,
which you can use for per ip/per port measurements, which can report on time
intervals.

I also use iptables & mrtg together like this:

iptables -N mrtg-from-the-internet > /dev/null 2> /dev/null
iptables -N mrtg-to-the-internet > /dev/null 2> /dev/null

iptables -A INPUT -i eth0 \! -s 213.244.168.192/26 -j mrtg-from-the-internet
iptables -A OUTPUT -o eth0 \! -d 213.244.168.192/26 -j mrtg-to-the-internet

and then:

Target[traffic]: `/var/www/mrtg.ds9a.nl/traffic`

and /var/www/mrtg.ds9a.nl/traffic:

#!/bin/sh
/sbin/iptables -L -n -v -x | grep mrtg- |grep "^ " | awk "{print \$2}"
uptime
uname -a

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
Trilab                                 The Technology People
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/

Re: [LARTC] Monitoring traffic

[Arkadiusz Miskiewicz]

RoMaN SoFt / LLFB <roman@madrid.com> writes:

> Before that I
> need to do some kind of study about our traffic to determine the best
> way of distribute our bandwidth. For that reason I'd like some tool
> that could retrieve this information:
...
>  Which tool would you use? Thanks in advance.
Try ntop - www.ntop.org.

-- 
Arkadiusz Mi¶kiewicz   IPv6 ready PLD Linux at http://www.pld.org.pl
misiek(at)pld.org.pl   AM2-6BONE, 1024/3DB19BBD, arekm(at)ircnet, PWr

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/

Re[2]: [LARTC] Monitoring traffic

[Fabian Gervan]

Hello Arkadiusz,

>> Before that I
>> need to do some kind of study about our traffic to determine the best
>> way of distribute our bandwidth. For that reason I'd like some tool
>> that could retrieve this information:

I use wipl, it show screen as this:
Start time: 2001-09-22 22:25:35
End time  : 2001-09-22 22:25:47

MAC               | IP              | Send        | Rcvd
---------------------------------------------------------------
00:00:f0:64:04:23 | 10.0.1.17       |     0.1KB/s |     3.2KB/s
00:00:f0:64:07:25 | 10.0.1.21       |     8.1KB/s |     0.2KB/s
00:00:f0:64:07:3a | 10.0.1.16       |     0.0KB/s |     0.0KB/s
00:00:f0:64:07:98 | 10.0.1.24       |     0.2KB/s |     4.1KB/s
00:00:f0:64:08:29 | 10.0.1.42       |     0.0KB/s |     0.0KB/s
00:00:f0:64:08:4f | 10.0.1.26       |     0.2KB/s |     2.0KB/s
00:00:f0:64:08:58 | 10.0.1.12       |     0.1KB/s |     0.2KB/s
00:00:f0:64:0c:fd | 10.0.1.44       |     0.0KB/s |     0.0KB/s
00:00:f0:64:0d:00 | 10.0.1.62       |     0.2KB/s |     0.2KB/s
00:00:f0:64:0d:04 | 10.0.1.18       |     5.3KB/s |     0.6KB/s
00:00:f0:64:0d:0b | 10.0.1.22       |     0.0KB/s |     0.1KB/s
00:02:2d:29:f1:bc | 10.0.2.12       |     0.1KB/s |     3.1KB/s
00:40:96:44:58:64 | 10.0.1.34       |     9.7KB/s |     0.2KB/s
00:40:96:47:22:0b | 10.0.1.10       |     0.1KB/s |     3.6KB/s
00:50:fc:1e:3d:be | 10.0.2.50       |     0.2KB/s |     3.6KB/s
00:e0:7d:9f:3b:c8 | 10.0.1.77       |     0.1KB/s |     0.1KB/s
---------------------------------------------------------------
                  |                 |    24.4KB/s |    21.2KB/s

search wipl in freshmeat.

Regards
Fabian



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/

[LARTC] Monitoring traffic

[Alex]

Does anybody know a good ip traffic monitoring software that has multiuser
capability?
I need some type of software with an interface on which users can login with
their user/pass and see how much traffic (how many megabytes) they consumed
over a certain period of time. Speed graphs are NOT a must, just something
to show them hou much traffic they did.
I'm currently using net-acct mysql but with little success because on RH9
the netacctd daemon dies unexpectedly sometimes without any error.

Thanks!

Alex


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Monitoring traffic

[Alex]

This approach is not good for me because I curently have 90 clients to count
traffic for and I expect another 50 in the next month, maybe more. I have
used this script that you say, but it would be a pain to implement that for
so many clients adn it would also put a good amount of load on the machine
running this setup. So I need something else... this works, but I should
create specific mrtg.cfg files for each client ( I don't think I can specify
htmldir and such... for every entry in mrtg.cfg) adn this is another issue
besides the most important one, THE LOAD!

Thanks anyway.....but maybe some of you know any better solutions?

Alex

----- Original Message ----- 
From: "Gabriel Lorenzo" <needle@arrakis.es>
To: "Alex" <alex@hostingcenter.ro>
Sent: Wednesday, August 27, 2003 12:32 AM
Subject: Re: [LARTC] Monitoring traffic


> Here is my tip.
>
>  Install MRTG  (www.mrtg.org ) into your Server/Gateway , if its a eg
Cisco
> Router where
> the customers are atached install a Computer with Linux with mrtg and
query
> with mrtg the Cisco router
> on eachinterface where you have customers attached, otherwise do it on
your
> Gateway and wuery your Interfaces-
>     While Mrtg creates automatically HTML pages with the results of daily,
> weekly, monthly and yearly traffic statistics.
> you need also to run a script writen by Joseph Wendel called Mrtg
Totalizer,
> very cool!, which counts the packets in/out
> collected by Mrtg. So you have both the totals packets consumed by your
> customers and the average statistics graphs.
> the next thing is to create individual html sites for each customer with
> .htaccess password restrictions, maybe using
> virtual domains for every customer for have them seperated.
>
>         I hope this helps.
>
>         If you need some more advice send me a mail
>
>                 Regards Osgaldo.
>
>
>
> ----- Original Message -----
> From: "Alex" <alex@hostingcenter.ro>
> To: "LARTC" <lartc@mailman.ds9a.nl>
> Sent: Tuesday, August 26, 2003 10:55 PM
> Subject: [LARTC] Monitoring traffic
>
>
> > Does anybody know a good ip traffic monitoring software that has
multiuser
> > capability?
> > I need some type of software with an interface on which users can login
> with
> > their user/pass and see how much traffic (how many megabytes) they
> consumed
> > over a certain period of time. Speed graphs are NOT a must, just
something
> > to show them hou much traffic they did.
> > I'm currently using net-acct mysql but with little success because on
RH9
> > the netacctd daemon dies unexpectedly sometimes without any error.
> >
> > Thanks!
> >
> > Alex
> >
> >
> > _______________________________________________
> > LARTC mailing list / LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Monitoring traffic

[Stef Coene]

On Wednesday 27 August 2003 03:00, Alex wrote:
> This approach is not good for me because I curently have 90 clients to
> count traffic for and I expect another 50 in the next month, maybe more. I
> have used this script that you say, but it would be a pain to implement
> that for so many clients adn it would also put a good amount of load on the
> machine running this setup. So I need something else... this works, but I
> should create specific mrtg.cfg files for each client ( I don't think I can
> specify htmldir and such... for every entry in mrtg.cfg) adn this is
> another issue besides the most important one, THE LOAD!
>
> Thanks anyway.....but maybe some of you know any better solutions?
I don't think there is a solution, but it's not so difficult to script this.  
You can use iptables counters to count the packets and rrdtool to create the 
graphs.  And you need some scripts so you can easy add more clients.

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/