Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux box set up running as a router using iptables.

My question is: What is the best way to monitor the traffic passing through it, on a per-IP basis? I've tried using Ntop, but it just gives me the shits, associates computer names with other peoples IP's etc...

Surely there's something out there that doesn't try sniff the whole network, but just what traffic is actually passing through the network cards ON the router/box??

Also, iptables logs are proving useless to me.. I can't get it to show traffic flows correctly, I.e. remote traffic is always shown as going to the routers IP, not the actual client IP on the LAN..

Any help MUCH appreciated, cheers.

share|improve this question
see… basically you want something that works with flows.. – Justin Feb 25 '10 at 2:39

Have you looked into Smoothwall. I set it up at home on a very old machine. I let it handle DHCP also.

I like it for the stats and because its sort of a 'project' for me.

Edit: to be more clear, there are several different possible configurations. I am running all traffic, including a wireless router though my Smoothwall machine. Internet comes into my cable modem and goes straight to the Smoothwall box, then out to an 8-port switch. From there it goes to a wireless router and to a few wired machines. I can monitor traffic/bandwidth in real time and/or look at history in graph or text form. I am still a newbie, but am having a great time with it.

Another Edit: I am not sure this would be appropriate for a huge network and, after rereading the question, I am not sure it is what you are looking for, but I am leaving it up for the info.

share|improve this answer
Tried installing smoothwall on this particular machine, don't know if the installers just a load of fail, but it couldn't load drivers for the NIC's for some reason... (RTL**) – gerard Feb 25 '10 at 2:24
bummer.....I had problems with realtek NICs also. I ended up rummaging through a box of old cards I had until I found two that it recognized. I ended up installing it 7-8 times before getting it up and running. – cop1152 Feb 25 '10 at 2:28
  1. On a switched network (typical today) the only IP traffic that a router sees will be the traffic it is processing (routing across its ports).
  2. Most sniffing tools are capable of skipping name lookups (to show actual IP values for example)
  3. You can add additional lines to your filter rules for logging specific IP packets
    • this will be easier if you know the IP addresses you want to meter and they are a handful rather than a whole subnet
share|improve this answer

I thing you might worth trying

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.