[AusNOG] monitoring interface

[Ross Wheeler]

> I have a client who has a linux box set up as a router on a telstra
> ethernet lite BDSL link.
> They want to monitor usage per ip address going through the box...
> It has 2 interfaces
> eth0 going to the internet
> eth1 going to the internal network (192.168.0.0)
>
> How to monitor the traffic on either interface to yield useful results in
> terms of ip address and its related data usage...?
>
> It would have to be command line or log to a file for later analysis
> elsewhere...

ipfw has "count" rules that make this really easy.
As an alternative, I wrote a tcpdump-like program that (amongst other 
things) can write ip-flow like output that you can pipe to another program 
or directly to a file that lets you do pretty good breakdown after the 
event.

You could use tcpdump to do the same thing, at a pinch.