Re: Packet counting/auditing per IP

Michael Mansour
Mon, 22 Jan 2007 07:39:38 -0000

Hi Pieter,

I actually implemented Simon''s scripts and they seem to have worked
fine. Although I couldn''t figure out how to get the rrd graphs out so I
download and installed cacti.

It''s quite an impressive piece of software, all installed and working
but I''m struggling to understand how to get cumulative bandwidth usage
graphs out of it.

I use Simon''s method for creating the ip-stats.rrd file and updating it
every minute from cron (I realise this can be done by cacti but I''m
still too new to it to figure out how), and I get cacti to read the file and
generate graphs from it (although they can''t seem to show bandwidth
usage graphs).

Basically what I am after is the ability to pull out the bandwidth usage per IP
so I know which servers are consuming the most bandwidth resources.

shorewall easily does this through it''s accounting features, but I
really need to correlate that data to show hourly, daily, monthly and yearly
totals of bandwidth usage per IP.

If anyone can suggest something here I''d appreciate it.

Thankyou.

Michael.

----- Original Message ----
From: Pieter Ennes <shorewall@spam.ennes.net>
To: Shorewall Users <shorewall-users@lists.sourceforge.net>
Sent: Friday, 19 January, 2007 10:49:30 AM
Subject: Re: [Shorewall-users] Packet counting/auditing per IP


Hi Michael,

Michael Mansour wrote:
> Hi,
>
> I''m using shorewall 2.4.9 running on Scientific Linux 4.4 (RHEL 4
Update 4).
>
> I handle various subents and IP''s for various clients, and they
all go through the shorewall firewall system.
>
> Some clients have subnets, some have only single IP''s.
>
> I''d like to start counting the bandwidth they are using, whether
that be for subnets or IP''s on their dedicated servers.
>
> Can shorewall do this? if so, how? will I need to upgrade the shorewall
version?

Shorewall can do some things in that area, just read about it here:
http://www.shorewall.net/Accounting.html

> If not, what is the best way to do this considering the hosting environment
is all Linux based (apart from the HP procurve switches which are used).

I''m personally very fond of SNMP in combination with Cacti. If
that''s
too much, it would probably be easy to hack up something using only
ifconfig/rrdtool or snmp/rrdtool.

http://www.cacti.net/

--
- Pieter

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net''s Techsay panel and you''ll get the chance
to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Send instant messages to your online friends http://au.messenger.yahoo.com