I'd like package NeTraMet.
NeTraMet is an accounting meter which runs on a PC under DOS or a Unix
system. It builds up packet and byte counts for traffic flows, which are
defined by their end-point addresses. Addresses can be ethernet addresses,
protocol addresses (IP, DECnet, EtherTalk, IPX or CLNS) or 'transport'
addresses (IP port numbers, etc), or any combination of these. The traffic
flows to be observed are specified by a set of rules, which are downloaded
to NeTraMet by a 'manager' program. Traffic flow data is collected via
SNMP from NeTraMet by a 'collector' program.
Home page: http://www2.auckland.ac.nz/net/NeTraMet/