Re: Packet counting/auditing per IP

Simon Hobson
Mon, 22 Jan 2007 09:31:08 -0000

>Although I couldn''t figure out how to get the rrd graphs out so I
>download and installed cacti.

OK, here are some hints that may help. This is off-topic for this
list, but if you are still stuck after reading the rrd doc pages etc,
then there is an rrd mailing list.


The scripts I wrote are ''a bit crude'', though I suppose
writing CGI
in bash is never going to be too elegant. Many people use Perl, but I
haven''t learned that !

Much of the script is concerned with making the rest of the html page
(menus and stuff), but the key bit is building an rrdtool script.
This is a procedure* that puts the relevant code into a temp file,
and then calls rrdtool to generate the actual output. The way I''m
doing it is the script will generate a graphic file (if required) and
simply output the html to load that image (ie ).

* I also have a simpler procedure that just plots one ip address.
Also, the time span is passed as a parameter.


Another technique used is to have the image reference itself be a CGI
which dynamically creates the image file (ie <IMG
SRC=dograph.cgi?param=x?param=y...>.

Once I have built the script file, I then call rrdtool to create the image :

/usr/bin/rrdcgi --filter ${TempFile}


Sample script (note, if you look at those long CDEFs in the middle
you''ll see that this script didn''t do every IP, just the ones
we have
things attached to) :


         <RRD::GRAPH /var/www/graphs/gr1det-off-7d.png
         --title="All active devices - Last Week" -v
"bytes/second"
         --end 1167822000 --start end-300h
         --lazy
         --width 600 --height 300
         --imginfo ''<IMG SRC="../graphs/%s" width=%lu
height=%lu
ALT="Graph data for of All active devices over Last
Week">''

         DEF:1-in=/var/rrd/ip-stats.rrd:ip1-in:AVERAGE
         DEF:1-out=/var/rrd/ip-stats.rrd:ip1-out:AVERAGE
         CDEF:i1-out=1-out,-1,*
         VDEF:v1-in=1-in,AVERAGE
         VDEF:v1-inmax=1-in,MAXIMUM
         VDEF:v1-out=1-out,AVERAGE
         VDEF:v1-outmax=1-out,MAXIMUM

         DEF:2-in=/var/rrd/ip-stats.rrd:ip2-in:AVERAGE
         DEF:2-out=/var/rrd/ip-stats.rrd:ip2-out:AVERAGE
         CDEF:i2-out=2-out,-1,*
         VDEF:v2-in=2-in,AVERAGE
         VDEF:v2-inmax=2-in,MAXIMUM
         VDEF:v2-out=2-out,AVERAGE
         VDEF:v2-outmax=2-out,MAXIMUM

         DEF:3-in=/var/rrd/ip-stats.rrd:ip3-in:AVERAGE
         DEF:3-out=/var/rrd/ip-stats.rrd:ip3-out:AVERAGE
         CDEF:i3-out=3-out,-1,*
         VDEF:v3-in=3-in,AVERAGE
         VDEF:v3-inmax=3-in,MAXIMUM
         VDEF:v3-out=3-out,AVERAGE
         VDEF:v3-outmax=3-out,MAXIMUM

....



CDEF:datainavg=1-in,2-in,+,3-in,+,4-in,+,6-in,+,9-in,+,12-in,+,13-in,+,14-in,+,15-in,+,17-in,+,18-in,+,19-in,+,21-in,+,22-in,+,24-in,+,25-in,+,26-in,+,27-in,+,28-in,+,29-in,+,30-in,+,40-in,+,41-in,+,42-in,+,43-in,+,44-in,+,50-in,+,51-in,+,60-in,+,68-in,+,69-in,+,71-in,+,84-in,+,85-in,+,86-in,+,87-in,+,88-in,+,93-in,+,98-in,+,99-in,+,105-in,+,108-in,+,109-in,+,110-in,+,112-in,+,115-in,+,121-in,+,122-in,+,123-in,+,126-in,+,134-in,+,158-in,+,160-in,+,161-in,+,162-in,+,165-in,+,166-in,+,201-in,+,202-in,+,239-in,+,240-in,+,254-in,+
         VDEF:vdatainavg=datainavg,AVERAGE

CDEF:dataoutavg=1-out,2-out,+,3-out,+,4-out,+,6-out,+,9-out,+,12-out,+,13-out,+,14-out,+,15-out,+,17-out,+,18-out,+,19-out,+,21-out,+,22-out,+,24-out,+,25-out,+,26-out,+,27-out,+,28-out,+,29-out,+,30-out,+,40-out,+,41-out,+,42-out,+,43-out,+,44-out,+,50-out,+,51-out,+,60-out,+,68-out,+,69-out,+,71-out,+,84-out,+,85-out,+,86-out,+,87-out,+,88-out,+,93-out,+,98-out,+,99-out,+,105-out,+,108-out,+,109-out,+,110-out,+,112-out,+,115-out,+,121-out,+,122-out,+,123-out,+,126-out,+,134-out,+,158-out,+,160-out,+,161-out,+,162-out,+,165-out,+,166-out,+,201-out,+,202-out,+,239-out,+,240-out,+,254-out,+
         VDEF:vdataoutavg=dataoutavg,AVERAGE


         COMMENT:"  IP Address        In avg       In max
Out avg      Out max\n"

         AREA:1-in#FF7F7F:"x.y.z.1  "
         GPRINT:v1-in:"%6.2lf %sBps"
         GPRINT:v1-inmax:"%6.2lf %sBps"
         COMMENT:" "
         GPRINT:v1-out:"%6.2lf %sBps"
         GPRINT:v1-outmax:"%6.2lf %sBps"
         COMMENT:" host1.mydomain\n"

         AREA:2-in#7FFF7F:"x.y.z.2  ":STACK
         GPRINT:v2-in:"%6.2lf %sBps"
         GPRINT:v2-inmax:"%6.2lf %sBps"
         COMMENT:" "
         GPRINT:v2-out:"%6.2lf %sBps"
         GPRINT:v2-outmax:"%6.2lf %sBps"
         COMMENT:" host2.mydomain\n"

         AREA:3-in#7F7FFF:"x.y.z.3  ":STACK
         GPRINT:v3-in:"%6.2lf %sBps"
         GPRINT:v3-inmax:"%6.2lf %sBps"
         COMMENT:" "
         GPRINT:v3-out:"%6.2lf %sBps"
         GPRINT:v3-outmax:"%6.2lf %sBps"
         COMMENT:" fw.furness.net\n"

....

         AREA:254-in#FF3F3F:"x.y.z.254":STACK
         GPRINT:v254-in:"%6.2lf %sBps"
         GPRINT:v254-inmax:"%6.2lf %sBps"
         COMMENT:" "
         GPRINT:v254-out:"%6.2lf %sBps"
         GPRINT:v254-outmax:"%6.2lf %sBps"
         COMMENT:" gate.mydomain\n"

         AREA:i1-out#FF7F7F:
         AREA:i2-out#7FFF7F::STACK
         AREA:i3-out#7F7FFF::STACK
....
         AREA:i254-out#FF3F3F::STACK

         COMMENT:"\n"
         COMMENT:"In  avg"
         GPRINT:vdatainavg:"%6.2lf %sBps\n"

         COMMENT:"Out avg"
         GPRINT:vdataoutavg:"%6.2lf %sBps"

         COMMENT:"  Data to 11\:00 Wed 03 Jan 2007\n"