Re: IP Traffic Accounting

[Ramin Alidousti <ramin@cannon.eng.us.uu.net>]

On Mon, Jun 24, 2002 at 10:33:00AM -0500, Jason R. Martin wrote:

> > IPaudit will probably be quite ok for a Workstation providing Internet 
> > connections to other home users or small office, if security on the 
> > Internal interface is not a concern. Also, a standalone machine to 
> > monitor traffic may be a simple setup, and performance may not be such 
> > an issue for a small number of hosts when using a no-switch Hub. 

You, of course, can use a switch and mirror all traffic to a port
where your NIDS or accounting application hangs off of.

Ramin

> > Performance will not be hampered at all if you can get hold of an 
> > ethernet bridging device.
> 
> Yeah, using a hub would definitely not work for me.  I run ipaudit directly
> on the firewall, where I have yet to see any sort of performance hit, even
> with roughly 800-1000 users.  Every 30min I get a ~300k file.  I'm working
> on ways of using the information through a MySQL database instead of the
> flat text files that ipaudit produces.  We'll see if anything fun comes of
> that :-)
> 
> Jason