On Tue, May 21, 2002 at 01:20:13PM +1000, Brian May wrote:
> Whats the best way in Debian to monitor IP packets sent/received over
> an external (ie. volume charged) connection? ie. How many bytes did
> host A receive on what port? Which internal host received the most
> external traffic? etc?
iptables -N eth0_in
iptables -N eth0_out
iptables -A INPUT -j eth0_in -i eth0 -d <ip of eth0>
iptables -A INPUT -j eth0_out -i eth0 -s <ip of eth0>
iptables -A eth0_in ...
iptables -A eth0_out ...
Periodically:
iptables -L eth0_in -n -v | grep for counts ... etc
iptables -L eth0_out -n -v | grep for counts ... etc
Or, use a program that works off these principles: ipac-ng. Simple,
uses the filtering abilities of the kernel, works well.
--
Chad Walstrom <chewie@wookimus.net> | a.k.a. ^chewie
http://www.wookimus.net/ | s.k.a. gunnarr
Attachment:
pgpQTaL7S8l__.pgp
Description: PGP signature