0

I've got a FreeBSD server running and it proxies some traffic to other IPs behind it, including a few dedicated ports for some services, and some webpages that are virtual hosts hitting the same IP:80. I'm using the 'pf' packet filter as my firewall.

I want to be able to log all this traffic and keep statistics in some sort of format. My requirement is just to get an idea of what kind of traffic comes in/out of this server and the ones behind it, and to view the trending over time.

How should I achieve this?

4 Answers 4

1

Argus may be what you are looking for:

http://www.qosient.com/argus/

1
  • Very cool looking tool, this makes me see that what I'm actually after is probably just bandwidth usage.. thank you
    – Nektarios
    May 25, 2011 at 19:13
1

The ng_netflow netgraph module combined with some creative use of netflow analysis tools (search for "netflow" here for even more ideas) can do what you want with an incredibly useful level of detail.

0

I would use Wireshark to view this information. Also up on the FreeBSD forums there are ~57 posts talking about Wireshark being used to monitor and troubleshoot various things.

1
  • That's more a temporary-use tool for a specific issue, over time it won't do much for me I'm thinking
    – Nektarios
    May 25, 2011 at 19:13
0

I'd go for "pmacct" combined with pNRG:

pmacct is a set of network tools to gather IP traffic
informations (bytes counter and number of packets); aggregation
of statistics is done using simple primitives (MAC addresses,
source host, destination host, ports and ip protocols) that can
be used alone or combined together to form complex aggregation
methods; counters are either global or historical (broken at
fixed timeslots). Data is either stored in a memory table,
pulled to stdout or in a SQL database (MySQL or PostgreSQL).
Gathering packets off the wire is done either using pcap
library (and promiscuous mode of the listening interface) or
reading Netflow packets coming from the network.

The website also has a selection of links, providing "some tools related to or topped over pmacct", e.g. BWStat.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .