Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have following set up :

a machine with a public IP with several machines with static IP behind it (NAT).

How would I monitor the traffic they generate on a per IP basis (the LAN ip to which traffic gets forwarded) ?

share|improve this question
up vote 2 down vote accepted

I think you can use some netflow sensor (for example fprobe, ipcad) and then export it to some collector. I used UTM5, but it's paid. I think there should be some free netflow collectors. For momentary snapshot of traffic you can use iftop.

share|improve this answer

If your gateway box is running Linux, you could use an iptables -j LOG parameter. Something like this:

iptables -A FORWARD -i eth1 -o eth0 -j LOG

You'd then have to configure your syslog to send that log data somewhere where the I/O won't hurt the process. You could also limit the I/O required by only logging tcp connection packets. Just replace the above with this:

iptables -A FORWARD -i eth1 -o eth0 -p tcp --syn -j LOG
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.