Traffic monitoring

chrism · Guru Joined: 15 Jul 2004 Posts: 526

Hallo everyone,

we have a server, which is acting as a samba-server, as a web-server and as a gateway. The workgroup consists of approximately 25 clients.
The problem I have, is that I have to keep track of the amount of traffic each client sends via the gateway, and each client produces with the server itself.
I tried vnstat, which doesn't seem suitably since it only records the total amount of traffic. I also tried to get IPTables to do the job (https://forums.gentoo.org/viewtopic-t-617960.html), since the IP-Addresses are issued by a dhcp-server which is not under my control, it didn't work, though.
Anonther problem is, that due to legal reasons I am not allowed to sniff the traffic, so ethereal and wireshark are no good either.

It would be great if someone had a solution.

Thanks,
Chris

octanez · Posted: Thu Apr 17, 2008 2:55 pm Post subject:

Have you taken a look at ntop?

I am not sure what kind of reports you need to generate but it might be a good place to start.
_________________
Adopt an orphan

chrism · Guru Joined: 15 Jul 2004 Posts: 526

I tried ntop, but unfortunally it logs too much. I am not allowed to even use a program which as the capability to trace the users actions. Only the amount of traffic they produce. :-(

I was thinking of something like vnstat, but instead of only having the network interfaces, having a list of all clients:
eg:

Hu · Moderator Joined: 06 Mar 2007 Posts: 20744

You could abuse iptables for this. I think the last time I suggested this, someone else almost immediately posted a more elegant solution. However, I do not recall what that solution was, and a quick search of old posts does not reveal it.

DarKRaveR · Posted: Fri Apr 18, 2008 6:18 am Post subject:

1.) Use Iptables ... which is quite cumbersome, if you have dynamic IPs
2.) Use tcpdump and snap only the header (snaplen=20 - ip header only)
3.) Write something yourself?

All other Options are more or less derivates of the same thing, you will have to look into the packets, no matter what ...

bradp_84 · n00b Joined: 06 Nov 2004 Posts: 48 Location: Australia

If you want to use the iptables approach, you could always configure dhcp to give out static IP's. I.e. map an IP to a MAC in the dhcp configuration.

tutaepaki · Posted: Fri Apr 18, 2008 9:45 pm Post subject:

take a look at ipaudit

theotherjoe · Guru Joined: 22 Nov 2003 Posts: 393

another tool you may want to have a look at
is iptraf; it's in portage.
http://iptraf.seul.org/

-Craig- · Guru Joined: 03 Jun 2004 Posts: 333

iptraf is not an option.
I'd recommend to use iptables -nvxZL & some bash/sed/awk & a mysql backup.
You'd have to write that on your own, of course...