Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a FreeBSD server running and it proxies some traffic to other IPs behind it, including a few dedicated ports for some services, and some webpages that are virtual hosts hitting the same IP:80. I'm using the 'pf' packet filter as my firewall.

I want to be able to log all this traffic and keep statistics in some sort of format. My requirement is just to get an idea of what kind of traffic comes in/out of this server and the ones behind it, and to view the trending over time.

How should I achieve this?

share|improve this question

Argus may be what you are looking for:

share|improve this answer
Very cool looking tool, this makes me see that what I'm actually after is probably just bandwidth usage.. thank you – Nektarios May 25 '11 at 19:13

The ng_netflow netgraph module combined with some creative use of netflow analysis tools (search for "netflow" here for even more ideas) can do what you want with an incredibly useful level of detail.

share|improve this answer

I would use Wireshark to view this information. Also up on the FreeBSD forums there are ~57 posts talking about Wireshark being used to monitor and troubleshoot various things.

share|improve this answer
That's more a temporary-use tool for a specific issue, over time it won't do much for me I'm thinking – Nektarios May 25 '11 at 19:13

I'd go for "pmacct" combined with pNRG:

pmacct is a set of network tools to gather IP traffic
informations (bytes counter and number of packets); aggregation
of statistics is done using simple primitives (MAC addresses,
source host, destination host, ports and ip protocols) that can
be used alone or combined together to form complex aggregation
methods; counters are either global or historical (broken at
fixed timeslots). Data is either stored in a memory table,
pulled to stdout or in a SQL database (MySQL or PostgreSQL).
Gathering packets off the wire is done either using pcap
library (and promiscuous mode of the listening interface) or
reading Netflow packets coming from the network.

The website also has a selection of links, providing "some tools related to or topped over pmacct", e.g. BWStat.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.