Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to build a linux router (captive portal) with a local RADIUS server for authentication.

I want to log the bandwidth being used by each client on my network. I want to associate bandwidth at a given point in time with MAC address. My question is, how can I get the bandwidth of a current client on my network? I understand that I will need to use IP address to get this information and then look at my ARP table to determine the MAC.

I understand RADIUS accounting can do this, but I do not want to use that approach at the moment.

Ideally, I would use this information to write a small C daemon that will save this data to a mysql database for later analysis.

Thanks in advance!

Ethan

share|improve this question
    
Wired or wireless (both to clients and to the Internet)? Are you planning to use PC hardware or a SoHo router? –  David Schwartz Jan 19 '13 at 0:37
    
It is basically a mini PC with 6 NIC's. I'm only use 2. WAN and Subscriber (LAN). I am using packet forwarding and iptables to route LAN -> WAN and vise-versa. –  Ethan Hayon Jan 19 '13 at 1:31

1 Answer 1

up vote 2 down vote accepted

So long as the Internet connection and the client connections are different interfaces, you can catch everything at the routing level. You need two pieces: a NetFlow exporter to produce the data by watching the routing process and a NetFlow collector to collect the exported data and place it in a database.

If the collector only gives you IP addresses, you'll need get the IP address assignments by MAC address, probably from RADIUS accounting records.

share|improve this answer
    
Thanks, this looks like what I'm looking for! Instead of looking at the RADIUS accounting data to get the MAC, isn't it more accurate to use the current ARP table on the router. In the event that the same IP is reassigned, I could run into trouble counting on the RADIUS accounting data. –  Ethan Hayon Jan 19 '13 at 1:28
    
Either way. They should both work. –  David Schwartz Jan 19 '13 at 1:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.