Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have following set up :

a machine with a public IP with several machines with static IP behind it (NAT).

How would I monitor the traffic they generate on a per IP basis (the LAN ip to which traffic gets forwarded) ?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I think you can use some netflow sensor (for example fprobe, ipcad) and then export it to some collector. I used UTM5, but it's paid. I think there should be some free netflow collectors. For momentary snapshot of traffic you can use iftop.

share|improve this answer

If your gateway box is running Linux, you could use an iptables -j LOG parameter. Something like this:

iptables -A FORWARD -i eth1 -o eth0 -j LOG

You'd then have to configure your syslog to send that log data somewhere where the I/O won't hurt the process. You could also limit the I/O required by only logging tcp connection packets. Just replace the above with this:

iptables -A FORWARD -i eth1 -o eth0 -p tcp --syn -j LOG
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.