I have following set up :

a machine with a public IP with several machines with static IP behind it (NAT).

How would I monitor the traffic they generate on a per IP basis (the LAN ip to which traffic gets forwarded) ?

2 Answers 2


I think you can use some netflow sensor (for example fprobe, ipcad) and then export it to some collector. I used UTM5, but it's paid. I think there should be some free netflow collectors. For momentary snapshot of traffic you can use iftop.


If your gateway box is running Linux, you could use an iptables -j LOG parameter. Something like this:

iptables -A FORWARD -i eth1 -o eth0 -j LOG

You'd then have to configure your syslog to send that log data somewhere where the I/O won't hurt the process. You could also limit the I/O required by only logging tcp connection packets. Just replace the above with this:

iptables -A FORWARD -i eth1 -o eth0 -p tcp --syn -j LOG

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.