Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to generate reports showing bandwidth usage broken down by port and protocol, based on all data sent/received over the last x days, in a fairly simple and secure way.

Storing full traffic dumps for later analysis is not an option here for privacy and resource reasons.

Being able to record these statistics in a simple way is important, because eventually I need to be able to combine these stats across all of the servers.

The target machines are running Debian, and minimal solutions would be better as many have below average specs. I have looked at nettop and it seemed like overkill, and I wasn't able to find the breakdown by port and protocol I needed.

Any advice would be greatly appreciated!

share|improve this question

2 Answers 2

If you only need this to and from the Internet (or other WAN link), you'd do better to use something like NetFlow on the router (you'll need a collector), rather than run stats on each machine. That will show you port, protocol, and endpoint statistics quite nicely.

Now, if you do need to measure LAN traffic as well, that won't work for you.

share|improve this answer

ntop is useful, simple to setup overall accounting. It is based on libpcap to watch traffic but does not store the raw dumps. The traffic data is then available in RRD format if you want to poke around further than the information ntop provides. The web interface does let you drill down into a lot of information.

http://localhost:3000/sortDataIP.html will report per IP - total and protocols

http://localhost:3000/dump.html will let you export a "Hosts/Long" report in text, json, perl, php, python or xml that includes all those counters. Probably best to save that off at a specific time each day and calculate the difference from the saved copies.

share|improve this answer
    
I'm not sure where to begin trying to get this information about of ntop , this is what I meant I'd tried in the OP (not nettop). –  YouCanCallMeBarry Jan 30 '13 at 8:44
    
Ah.. using 5.0.1? I just had a look at version 5 and it appears they've moved from simple /etc/services protocols and a -p option that let you define protocols to something called nDPI based on OpenDPI that doesn't detect any protocols for me via libpcap. Nice. I'll add the of where it should come from to the answer anyway –  mtm Jan 30 '13 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.