Measuring traffic that goes thrugh a specific IP

Measuring traffic that goes thrugh a specific IP

[gummi7]

Hello

I'm a linux/iptables/netfilter newbie, but I want to ask you a simple question.
It's a long story and unrellevant to tell you why I want to do it so i'll just get straigt to the point.

I want to be able to measure(with my linux router) all the traffic from the computers on my network that go thrugh a specifc IP number wich is located in another place in my country. That is, if a computer on my network accesses a website and goes trough a specifed IP number to get that website, I want to be able to measure the amount of data that goes trough that specified IP number, but only the data on my behalf. Note that I do not have phisical(nor telnet or ssh) access to the router with the specifed IP number that I want to measure.

Can I do that with iptables and/or ipfilter? A yes is all I have to hear if that is possible but an example or a little help wouldn't hurt :)

With reagards, Guðmundur Viktorsson

ps. Please say so if I don't make myself clear enough.

Re: Measuring traffic that goes thrugh a specific IP

[Joel Newkirk]

On Sunday 02 February 2003 05:11 pm, gummi7@simnet.is wrote:
> Hello
>
> I'm a linux/iptables/netfilter newbie, but I want to ask you a simple
> question. It's a long story and unrellevant to tell you why I want to
> do it so i'll just get straigt to the point.
>
> I want to be able to measure(with my linux router) all the traffic
> from the computers on my network that go thrugh a specifc IP number
> wich is located in another place in my country. That is, if a computer
> on my network accesses a website and goes trough a specifed IP number
> to get that website, I want to be able to measure the amount of data
> that goes trough that specified IP number, but only the data on my
> behalf. Note that I do not have phisical(nor telnet or ssh) access to
> the router with the specifed IP number that I want to measure.
>
> Can I do that with iptables and/or ipfilter? A yes is all I have to
> hear if that is possible but an example or a little help wouldn't hurt

If you mean that the specific IP is the destination of a packet, IE 
machines explicitly connect to that IP and it is listed in the header, 
there is no problem.  If you mean that the specific IP is simply a 
router somewhere that the traffic 'might happen' to pass through in its 
travels, I think you're out of luck.

You can tally all traffic to a specific destination IP with:

/sbin/iptables -d w.x.y.z

at the top of your FORWARD chain, and then "iptables -L -v -n" will list 
your rules, and this 'do-nothing' rule will list packet counts and byte 
totals that matched it without actually having DONE anything.  Adding 
'-j LOG --log-prefix "HIT:"' to the end of the above rule would log 
information on ALL packets with that IP as destination, but if this is a 
large amount of traffic then your /var/log/messages (default) logfile 
would chew up hard drive space at an apalling rate.

j

Re: Measuring traffic that goes thrugh a specific IP

[gummi7]

"If you mean that the specific IP is simply a router somewhere that the traffic 'might happen' to pass through in its travels"
That's exactly what I want to do :(
I can always find out if a packet passes trough that specifec IP(the one I want to measure, therefore being internatoinal) by using a tool like DOS's "tracert", doesn't that help?
Do you know of a program for linux that does what I am trying to do?

> On Sunday 02 February 2003 05:11 pm, gummi7@simnet.is wrote:
>> Hello
>>
>> I'm a linux/iptables/netfilter newbie, but I want to ask you a simple
>> question. It's a long story and unrellevant to tell you why I want to
>> do it so i'll just get straigt to the point.
>>
>> I want to be able to measure(with my linux router) all the traffic
>> from the computers on my network that go thrugh a specifc IP number
>> wich is located in another place in my country. That is, if a computer
>> on my network accesses a website and goes trough a specifed IP number
>> to get that website, I want to be able to measure the amount of data
>> that goes trough that specified IP number, but only the data on my
>> behalf. Note that I do not have phisical(nor telnet or ssh) access to
>> the router with the specifed IP number that I want to measure.
>>
>> Can I do that with iptables and/or ipfilter? A yes is all I have to
>> hear if that is possible but an example or a little help wouldn't hurt
> 
> If you mean that the specific IP is the destination of a packet, IE 
> machines explicitly connect to that IP and it is listed in the header, 
> there is no problem.  If you mean that the specific IP is simply a 
> router somewhere that the traffic 'might happen' to pass through in its 
> travels, I think you're out of luck.
> 
> You can tally all traffic to a specific destination IP with:
> 
> /sbin/iptables -d w.x.y.z
> 
> at the top of your FORWARD chain, and then "iptables -L -v -n" will list 
> your rules, and this 'do-nothing' rule will list packet counts and byte 
> totals that matched it without actually having DONE anything.  Adding 
> '-j LOG --log-prefix "HIT:"' to the end of the above rule would log 
> information on ALL packets with that IP as destination, but if this is a 
> large amount of traffic then your /var/log/messages (default) logfile 
> would chew up hard drive space at an apalling rate.
> 
> j
> 

Re: Measuring traffic that goes thrugh a specific IP

[Joel Newkirk]

On Thursday 06 February 2003 07:33 am, gummi7@simnet.is wrote:
> "If you mean that the specific IP is simply a router somewhere that
> the traffic 'might happen' to pass through in its travels" That's
> exactly what I want to do :(
> I can always find out if a packet passes trough that specifec IP(the
> one I want to measure, therefore being internatoinal) by using a tool
> like DOS's "tracert", doesn't that help? Do you know of a program for
> linux that does what I am trying to do?

"traceroute" is the Linux equivalent of "tracert".  It will trace a route 
to a given IP, and note all the IP's along the way.  It doesn't let you 
measure traffic from your box that flows through a given IP, though, and 
doesn't assure that your traffic actually follows that exact route.

j

Re: Measuring traffic that goes thrugh a specific IP

[gummi7]

Oh, yes, traceroute was it.
I know that traceroute can't measure traffic but I was thinking of something like this.
Connect to IP -> traceroute %IP -> grep "The-specified-ip-I-want-to-measure-the-my-traffic-trough" -> if(!grep-returned-none) then measure-traffic.
I know that this is not a shell script nor a program but this is a kind of a flowchart that explains what I want to do and the programs that I know that could be used. This methood is possible, right?
The only problem then is to get a program to pass the IP i'm connecting to, to traceroute. But what can be used to measure then traffic that the "if" tells it to measure. Can I use iptables to do that, or is there another program for linux that does that?

btw, for those of you who don't know the line "if(!grep-returned-none)" means: if grep does _not_ return none

> On Thursday 06 February 2003 07:33 am, gummi7@simnet.is wrote:
>> "If you mean that the specific IP is simply a router somewhere that
>> the traffic 'might happen' to pass through in its travels" That's
>> exactly what I want to do :(
>> I can always find out if a packet passes trough that specifec IP(the
>> one I want to measure, therefore being internatoinal) by using a tool
>> like DOS's "tracert", doesn't that help? Do you know of a program for
>> linux that does what I am trying to do?
> 
> "traceroute" is the Linux equivalent of "tracert".  It will trace a route 
> to a given IP, and note all the IP's along the way.  It doesn't let you 
> measure traffic from your box that flows through a given IP, though, and 
> doesn't assure that your traffic actually follows that exact route.
> 
> j
> 

RE: Measuring traffic that goes thrugh a specific IP

[Khanh Tran]

Assuming I'm understanding everything you are saying, 

You'd probably want to set up an interface on your local linux router that
will be used when routing traffic to this specified IP that is elsewhere.
Of course you'll next want to set a route to route all traffic to this
specific IP on this new interface.  This will isolate the traffic between
your local network and this specific IP to only that interface.  You could
then either use ifconfig, or cat /proc/net/dev to calculate the number of
packets, bytes, etc that traverse that interface.  I've even seen Perl
scripts that will take that data and send it to MRTG for some nice graphs.
I use that on my network to get stats from our campus routers.

Khanh Tran
Network Operations
Sarah Lawrence College



-----Original Message-----
From: gummi7@simnet.is [mailto:gummi7@simnet.is]
Sent: Sunday, February 02, 2003 5:11 PM
To: netfilter@lists.netfilter.org
Subject: Measuring traffic that goes thrugh a specific IP


Hello

I'm a linux/iptables/netfilter newbie, but I want to ask you a simple
question.
It's a long story and unrellevant to tell you why I want to do it so i'll
just get straigt to the point.

I want to be able to measure(with my linux router) all the traffic from the
computers on my network that go thrugh a specifc IP number wich is located
in another place in my country. That is, if a computer on my network
accesses a website and goes trough a specifed IP number to get that website,
I want to be able to measure the amount of data that goes trough that
specified IP number, but only the data on my behalf. Note that I do not have
phisical(nor telnet or ssh) access to the router with the specifed IP number
that I want to measure.

Can I do that with iptables and/or ipfilter? A yes is all I have to hear if
that is possible but an example or a little help wouldn't hurt :)

With reagards, Guðmundur Viktorsson

ps. Please say so if I don't make myself clear enough.