Shorewall users - Jul 2005 - Accounting Proxyarp users !!?

Hi Folks,

Can i account proxyarped pc´s ??

Like know how much web traffic passthru a specific person ip using shorewall ?

So i can know how much bandwidth that specific IP EAT ?

Thanks alot

Carlos Arnt



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click

>Hi Folks,
>
>Can i account proxyarped pc´s ??
>
>Like know how much web traffic passthru a specific person ip using
shorewall ?
>
>So i can know how much bandwidth that specific IP EAT ?
>
>Thanks alot
Sorry, I have no "hands on" experence with the accounting stuff.
http://www.shorewall.net/Accounting.html shows the basic layout.
Are you talking all traffic or just http?

Something like this for all traffic:

client1:COUNT       -       <ipofclient>    0.0.0.0/0            all
client1:COUNT       -       0.0.0.0/0         <ipofclient>       all
DONE            -       <ipofclient>    0.0.0.0/0           all
DONE            -       0.0.0.0/0        <ipofclient>       all
DONE    client1

rinse, lather, repeat, changing client1 and ipofclient for the next client.
Not sure how well this would scale....

"shorewall show client1" should show the traffic passed.

This is how I tested this:
accounting:
web:COUNT       -       10.3.0.12       0.0.0.0/0               all
web:COUNT       -       0.0.0.0/0       10.3.0.12               all
DONE    web
DONE            -       eth0    eth2            all
DONE            -       eth2    eth0            all

[root@shore jerico //sbin/shorewall show web
Shorewall-2.4.2 Chain web at shore.wp.shawcable.net - Wed Jul 27 14:14:18
CDT 20
05

Counters reset Wed Jul 27 14:13:01 CDT 2005

Chain web (2 references)
 pkts bytes target     prot opt in     out     source
destination

   59  4891            all  --  *      *       10.3.0.12
0.0.0.0/0

   53  8662            all  --  *      *       0.0.0.0/0
10.3.0.12

  112 13553 RETURN     all  --  *      *       0.0.0.0/0
0.0.0.0/0

*should* work in a proxyarp layout also, I just can''t test it.

Jerry












-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO September
19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing
& QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf

Jerry Vonau wrote:
>
> *should* work in a proxyarp layout also, I just can''t test it.
>
It works -- I use it all the time.

Remember folks -- Proxy ARP is nothing but plain old routing at the IP
level. Proxy ARP just fools the link level into thinking that the firewall
is the destination host.

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key