A practical problem regarding IP Accounting ...?

A practical problem regarding IP Accounting ...?

[toto eucup]

I have 32 IP ADDRESSE 11.22.33.64-96 
11.22.33.65 Router (cisco) I do not have access on it 
Big Brother proprerty-- BELL you know already :( ...
:)
 


My linux box 2 net interface
11.22.33.66 running DNS on eth0 and
11.22.33.67 on eth1


Here comes the scenario:
Betwen the router and Swich is my machine and I want
all the trafic to go through my Linux Box to be able
to account the trafic per IP addres.

              ROUTER -->INPUT<-- eth0
My Linux Box: eth0-->Accounting FILTER<--eth1
              eth1-->SWITCH<--  11.22.33.68 to 95


I want to be able  in my linux box to measure trafic
for all the station which are pluged in switch from 68
to 95

Thanks for an eventual complet solution.

    


 
I tried to do so
 
 [INTERNET] -->[ ROUTER:11.22.33.65] -->[ eth0(66)
 --eth1(67)] -->[HUB/switch]--> [station ([68].. to
 [95])]

How can I masure the trafic on each IP address in 68
to 95 range using your software.




	
		
Mit schönen Grüßen von Yahoo! Mail - http://mail.yahoo.de

Re: A practical problem regarding IP Accounting ...?

[Ted Kaczmarek]

Create a logging rule based upon the criteria you want. 
You can go as granular as you like.

Ted

On Tue, 2004-03-09 at 01:09 +0100, toto eucup wrote:

> I have 32 IP ADDRESSE 11.22.33.64-96 
> 11.22.33.65 Router (cisco) I do not have access on it 
> Big Brother proprerty-- BELL you know already :( ...
> :)
>  
> 
> 
> My linux box 2 net interface
> 11.22.33.66 running DNS on eth0 and
> 11.22.33.67 on eth1
> 
> 
> Here comes the scenario:
> Betwen the router and Swich is my machine and I want
> all the trafic to go through my Linux Box to be able
> to account the trafic per IP addres.
> 
>               ROUTER -->INPUT<-- eth0
> My Linux Box: eth0-->Accounting FILTER<--eth1
>               eth1-->SWITCH<--  11.22.33.68 to 95
> 
> 
> I want to be able  in my linux box to measure trafic
> for all the station which are pluged in switch from 68
> to 95
> 
> Thanks for an eventual complet solution.
> 
>     
> 
> 
>  
> I tried to do so
>  
>  [INTERNET] -->[ ROUTER:11.22.33.65] -->[ eth0(66)
>  --eth1(67)] -->[HUB/switch]--> [station ([68].. to
>  [95])]
> 
> How can I masure the trafic on each IP address in 68
> to 95 range using your software.
> 
> 
> 
> 
> 	
> 		
> Mit schönen Grüßen von Yahoo! Mail - http://mail.yahoo.de

RE: A practical problem regarding IP Accounting ...?

[Daniel Chemko]

# Outbound to PC
iptables -t mangle -A PREROUTING -i eth1 --source <ip_address>
# Inbound to PC
iptables -t mangle -A POSTROUTING -o eth1 --destination <ip_address>

Then use your own accounting tool to rip the byte count from "iptables -t mangle -nvxL". Remember though, the byte count can reset or overflow to 0, so make sure your accounting package can handle this.

toto eucup wrote:
> I have 32 IP ADDRESSE 11.22.33.64-96
> 11.22.33.65 Router (cisco) I do not have access on it
> Big Brother proprerty-- BELL you know already :( ...
> :)
> 
> 
> 
> My linux box 2 net interface
> 11.22.33.66 running DNS on eth0 and
> 11.22.33.67 on eth1
> 
> 
> Here comes the scenario:
> Betwen the router and Swich is my machine and I want
> all the trafic to go through my Linux Box to be able
> to account the trafic per IP addres.
> 
>               ROUTER -->INPUT<-- eth0
> My Linux Box: eth0-->Accounting FILTER<--eth1
>               eth1-->SWITCH<--  11.22.33.68 to 95
> 
> 
> I want to be able  in my linux box to measure trafic
> for all the station which are pluged in switch from 68
> to 95
> 
> Thanks for an eventual complet solution.
> 
> 
> 
> 
> 
> I tried to do so
> 
>  [INTERNET] -->[ ROUTER:11.22.33.65] -->[ eth0(66)
>  --eth1(67)] -->[HUB/switch]--> [station ([68].. to
>  [95])]
> 
> How can I masure the trafic on each IP address in 68
> to 95 range using your software.
> 
> 
> 
> 
> 
> 
> Mit schönen Grüßen von Yahoo! Mail - http://mail.yahoo.de

Re: A practical problem regarding IP Accounting ...?

[Antony Stone]

On Tuesday 09 March 2004 1:02 am, Daniel Chemko wrote:

> # Outbound to PC
> iptables -t mangle -A PREROUTING -i eth1 --source <ip_address>
> # Inbound to PC
> iptables -t mangle -A POSTROUTING -o eth1 --destination <ip_address>
>
> Then use your own accounting tool to rip the byte count from "iptables -t
> mangle -nvxL". Remember though, the byte count can reset or overflow to 0,
> so make sure your accounting package can handle this.

I think this is an excellent answer, but there are some subtleties about it 
which Daniel did not empphasise, and I think they're worth explaining so 
people understand a little more about netfilter:

1. The rules have no targets!   ie: there is no "-j ACCEPT" etc at the end.   
This is perfectly correct and acceptable (in any chain, not just mangle), and 
means the netfilter will count the packets which match, but not do anything 
special with them.   Such a rule is useful only for counting packets & bytes, 
but it means you can count them without immediately deciding what happens to 
them - you can sgtill follow the accounting rules with your normal filtering 
/ natting / mangling rules.

2. The rules are in the mangle tables because this is the closest that 
netfilter can get to the interfaces themselves, and it makes sure that the 
rules really do count all the packets going in and out of the machine, 
without some quietly slipping past behind the scenes as they could do if you 
counted packets in the nat table (the rules would not see reply packets being 
automatically de-natted), or the filter table (where it would be difficult to 
combine sensible accounting with the stanadard stateful ESTABLISHED, RELATED 
rule).

I hope this helps a few people understand a bit more about why this is a very 
good solution to packet accounting, as well as perhaps a bit more about the 
way packets go through mangle, nat and filter.

Regards,

Antony.

-- 
Wanted: telepath.   You know where to apply.

                                                     Please reply to the list;
                                                           please don't CC me.