Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
can I see how much download a certain IP does?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Wed Mar 12, 2003 7:25 am    Post subject: can I see how much download a certain IP does? Reply with quote

I have an adsl connection shared, and squid runnning.

I can get a whole lot of info out of the logs, but what I want to know is the following (it may not be related to squid at all):

I want to see how much download a certain IP address uses over a month.

is this possible, either with squid, or some other way ?

thanks heaps!
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
Sven Vermeulen
Retired Dev
Retired Dev


Joined: 29 Aug 2002
Posts: 1345
Location: Mechelen, Belgium

PostPosted: Wed Mar 12, 2003 7:39 am    Post subject: Reply with quote

Not really what you want, but here every pc has a static IP. Upon deactivating the network it saves information gathered from ifconfig into the logs of the server. With that info we know fi how much data has been send/received:
Code:

eth1      Link encap:Ethernet  HWaddr 00:20:18:57:80:C6 
          inet addr:213.224.137.219  Bcast:213.224.137.255   
                                                                Mask:255.255.255.0
          inet6 addr: fe80::220:18ff:fe57:80c6/10 Scope:Link
          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500 
                                                                Metric:1
          RX packets:3028 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2835 errors:0 dropped:0 overruns:0 carrier:0
          collisions:160 txqueuelen:100
          RX bytes:2596733 (2.4 Mb)  TX bytes:323870 (316.2 Kb)
          Interrupt:12 Base address:0xe400


Fi the "RX bytes" contains how much data has been received, and "TX bytes" is the same for transmitted data.
Back to top
View user's profile Send private message
mglauche
Retired Dev
Retired Dev


Joined: 25 Apr 2002
Posts: 564
Location: Germany

PostPosted: Wed Mar 12, 2003 8:11 am    Post subject: Reply with quote

The easiest way would be to set up an iptables filter with that ip, and check the output of iptables -l -v monthly ... there are some packages that do this automatic (ipacct or so)
Back to top
View user's profile Send private message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Wed Mar 12, 2003 12:03 pm    Post subject: Reply with quote

ok.. thanks for the tips..

are there any ebuilds for such a thing?

can u think of any other way of doing it?

thanks again
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
psp
Tux's lil' helper
Tux's lil' helper


Joined: 06 Aug 2002
Posts: 120
Location: Cape Town, South Africa

PostPosted: Thu Mar 13, 2003 4:06 pm    Post subject: Reply with quote

What about calamari and other squid log analyzers?
Just a thought... (I know iptables will pickup all traffic, but if you want FTP, HTTP only...)
Back to top
View user's profile Send private message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Thu Mar 13, 2003 9:11 pm    Post subject: Reply with quote

yeah there is one called webalizer.. I'm going to check that out.

didn't know about calamari, thanks.

they basically spit out what's in the logs and make them into pretty grafs and stuff...

cheers!
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
elfarto
n00b
n00b


Joined: 27 Feb 2003
Posts: 26
Location: Argentina

PostPosted: Thu Mar 13, 2003 11:01 pm    Post subject: Reply with quote

You may want to try cacti and/or cricket, cacti is available as a ebuid as
net-analyzer/cacti, you should implement iptables filters to allow counting the traffic for a given ip, search around in the cacti web site for a pre made script that does the trick, a word of warning thou, i found several bugs in cacti, and the interface could be improved.!
Back to top
View user's profile Send private message
Crg
Guru
Guru


Joined: 29 May 2002
Posts: 345
Location: London

PostPosted: Fri Mar 14, 2003 12:36 am    Post subject: Reply with quote

taskara wrote:
yeah there is one called webalizer.. I'm going to check that out.

didn't know about calamari, thanks.

they basically spit out what's in the logs and make them into pretty grafs and stuff...

cheers!


That will only show you what traffic has gone through squid, so not kazaa etc..

The best solution is "emerge ntop" on your gateway machine.
Run it something like "ntop -m x.x.x.x/x -i ppp0 -i eth0"
where x.x.x.x/x is your local network. Give it a couple of minutes to collect data then point your browser at port 3000 of that machine and look at the numbers and pretty graphs of whats going on.

(Once you have it working properly you can then run it as daemon - I don't suggest doing that the first time as you need to set a password so it won't work).
Back to top
View user's profile Send private message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Fri Mar 14, 2003 4:17 am    Post subject: Reply with quote

thanks guys.

Crg, that sounds like what I am after. Can you give me an example where my router is 10.0.0.1 and the pc I want to check usage on is 10.0.0.50 ?

what would that be:

ntop -m 10.0.0.50/ ?? -i ppp0 -i eth0

hope you can clarify for me!
thanks
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
Crg
Guru
Guru


Joined: 29 May 2002
Posts: 345
Location: London

PostPosted: Fri Mar 14, 2003 12:34 pm    Post subject: Reply with quote

taskara wrote:
thanks guys.

Crg, that sounds like what I am after. Can you give me an example where my router is 10.0.0.1 and the pc I want to check usage on is 10.0.0.50 ?

what would that be:

ntop -m 10.0.0.50/ ?? -i ppp0 -i eth0

hope you can clarify for me!
thanks


A made a mistake with the above example the interfaces are supposed to be separated by ",", so if you have an linux box setup with 1 ethernet card and dialup/adsl it would be:

Code:
ntop -m 10.0.0.0/24 -i pppo,eth0
Back to top
View user's profile Send private message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Fri Mar 14, 2003 12:53 pm    Post subject: Reply with quote

what's the "/24" ?
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
Crg
Guru
Guru


Joined: 29 May 2002
Posts: 345
Location: London

PostPosted: Fri Mar 14, 2003 2:36 pm    Post subject: Reply with quote

taskara wrote:
what's the "/24" ?


Subnet mask... its assuming you have a 24bit subnet mask otherwise written as 255.255.255.0, the "-m x.x.x.x/x" isn't that important it just lets ntop know what IPs are local for display/stats purposes.
Back to top
View user's profile Send private message
taskara
Advocate
Advocate


Joined: 10 Apr 2002
Posts: 3763
Location: Australia

PostPosted: Fri Mar 14, 2003 11:11 pm    Post subject: Reply with quote

ahhh ofcourse ;)

thanks.. I'll give it a go! and let you know my results.

ta
_________________
Kororaa install method - have Gentoo up and running quickly and easily, fully automated with an installer!
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum