Measuring traffic

Measuring traffic

[Rowan Reid]

Is there a way using IPTables to measure network traffic across the
firewall ? Perhaps even begin categorizing it by client.
 
Rowan Reid
Job Captain, 
Systems Administrator
STUDIO 3 ARCHITECTS
909  982  1717

Re: Measuring traffic

[Antony Stone]

On Thursday 12 September 2002 5:45 pm, Rowan Reid wrote:

> Is there a way using IPTables to measure network traffic across the
> firewall ? Perhaps even begin categorizing it by client.

iptables -A FORWARD -s a.b.c.d
or
iptables -A FORWARD -p tcp --dport 80
or both:
iptables -A FORWARD -s a.b.c.d -p tcp --dport 80

(Yes, there is no -j TARGET at the end of those commands).

Then
iptables -L FORWARD -n -v -x
will show you the packet & byte counts for each rule which matched packets - 
in this case, all packets from a specific source address, all packets 
containing http requests, or all http request packets from a specific source 
address.....

Antony.

-- 

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett

Re: Measuring traffic

[dizma]

try ipac-ng packet

http://sourceforge.net/projects/ipac-ng/

NN
----- Original Message ----- 
From: "Rowan Reid" <rreid@studio3arc.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, September 12, 2002 7:45 PM
Subject: Measuring traffic


> 
> 
> Is there a way using IPTables to measure network traffic across the
> firewall ? Perhaps even begin categorizing it by client.
>  
> Rowan Reid
> Job Captain, 
> Systems Administrator
> STUDIO 3 ARCHITECTS
> 909  982  1717
> 
> 

RE: Measuring traffic

[Rowan Reid]

Hi,

Thanks for the recommendation, Since you suggested I figured I would
ask. D you have a sampl ipac.conf file. The source file and compile
didn’t' create one and I'm having a hard time understanding the  exaple
. See insert.

INSTALLATION / CONFIG FILE.

The ipac.conf file is '/etc/ipac-ng/ipac.conf'. ipac.conf controls what
data
is collected. Each line which begins with a '#' is ignored. All the
other lines have the format

  Name of rule|direction|interface|protocol|source|destination

  where
  Name of rule          Any string to identify this rule
  direction             'in' or 'out'
  interface             ip number or interface name or empty
  protocol              'tcp' or 'udp' or 'icmp' or 'all'
  source                \
  destination           both as described in ipfwadm(8), or empty
 
In the summaries, the 'Name of rule' string identifies the counter.
Both the source and destination must be in ipfwadm/ipchains syntax -
consult the man page.

The interface can be named (for example, eth0) or its IP number can be
given.
Linux IP accounting always counts at one interface or at any interface.
The
direction means in or out of this interface.

* You must run the fetchipac -S after changing the 
* ipac.conf file every time for the changes to take effect!

An example ipac.conf file comes with the distribution.

Cant' find it anywhere in the source

> try ipac-ng packet
> 
> http://sourceforge.net/projects/ipac-ng/
> 

RE: Measuring traffic

[Rowan Reid]

Disregard ...
 
Rowan Reid
Job Captain, 
Systems Administrator
STUDIO 3 ARCHITECTS
909  982  1717


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Rowan Reid
> Sent: Friday, September 13, 2002 10:05 AM
> To: 'dizma'; netfilter@lists.netfilter.org
> Subject: RE: Measuring traffic
> 
> 
> 
> 
> Hi,
> 
> Thanks for the recommendation, Since you suggested I figured 
> I would ask. D you have a sampl ipac.conf file. The source 
> file and compile didn’t' create one and I'm having a hard 
> time understanding the  exaple . See insert.
> 
> INSTALLATION / CONFIG FILE.
> 
> The ipac.conf file is '/etc/ipac-ng/ipac.conf'. ipac.conf 
> controls what data is collected. Each line which begins with 
> a '#' is ignored. All the other lines have the format
> 
>   Name of rule|direction|interface|protocol|source|destination
> 
>   where
>   Name of rule          Any string to identify this rule
>   direction             'in' or 'out'
>   interface             ip number or interface name or empty
>   protocol              'tcp' or 'udp' or 'icmp' or 'all'
>   source                \
>   destination           both as described in ipfwadm(8), or empty
>  
> In the summaries, the 'Name of rule' string identifies the 
> counter. Both the source and destination must be in 
> ipfwadm/ipchains syntax - consult the man page.
> 
> The interface can be named (for example, eth0) or its IP 
> number can be given. Linux IP accounting always counts at one 
> interface or at any interface. The direction means in or out 
> of this interface.
> 
> * You must run the fetchipac -S after changing the 
> * ipac.conf file every time for the changes to take effect!
> 
> An example ipac.conf file comes with the distribution.
> 
> Cant' find it anywhere in the source
> 
> > try ipac-ng packet
> > 
> > http://sourceforge.net/projects/ipac-ng/
> > 
> 
>