I have a linux box set up running as a router using iptables.
My question is: What is the best way to monitor the traffic passing through it, on a per-IP basis? I've tried using Ntop, but it just gives me the shits, associates computer names with other peoples IP's etc...
Surely there's something out there that doesn't try sniff the whole network, but just what traffic is actually passing through the network cards ON the router/box??
Also, iptables logs are proving useless to me.. I can't get it to show traffic flows correctly, I.e. remote traffic is always shown as going to the routers IP, not the actual client IP on the LAN..
Any help MUCH appreciated, cheers.