Re: Bandwidth monitoring

[Brian May <bam@snoopy.apana.org.au>]

On Wed, 2002-05-22 at 23:33, Peter Palfrader wrote:
> On Wed, 22 May 2002, Brian May wrote:
> 
> > ipaudit-web looks pretty good, but I am not sure I have got it working
> > properly yet.
> 
> If you have a setup where your accounting box also sees local2local
> traffic some reports might still count them on one side or the other.
> AFAIK A friend of minde solved this by patching ipaudit to not even
> print local2local connections. If you encounter this problem I could ask
> my friend for some details.

Strange.

My understanding of the code is that local vs remote connections are
determined purely by IP numbers. I wonder how it would get this wrong?

The code is:

        # Test for Src/Dst  local/remote or remote/local
        $Location0  = &GetLocation ($ip[0]);
        $Location1  = &GetLocation ($ip[1]);
        $IsLocal0   = ($Location0 eq "L" || $Location1 eq "R");
        if ($Location0 eq $Location1 ) {
                if ($Location0 eq "L") {
                        $InternalComm += $Totb;
                } elsif ($Location0 eq "R") {
                        $ExternalComm += $Totb;
                } else {
                        $UnknownComm  += $Totb;
                }
                next;
        }

So if both ip addresses are L (local) it should count it as internal
communications.

(although my preferred method of determining local vs remote traffic
generally would be to look at what network interface it comes in on and
what network interface it goes out on...)

While ipaudit produces nice statistics in just the way I want, I am yet
to be convinced that it is the ideal solution, as:
        * gets terribly confused (like ntop does) with ippp0 device, it
          mis-parses the IP addresses.
        * coding seems to sloppy, there are several obvious errors (eg.
          "ps -aux" instead of "ps aux", attempts to compress the RAW
          log file even though one isn't being generated). Yesterday it
          was generating warnings via 30 min cron job that the Y range
          was null.

Eventually, I think I would like to generate ipaudit-web like statistics
using netramet, save these results in a tool like rrdtool for displaying
with something like cacti or remstats. (note: making a few assumptions
here that these tools are capable of being used like this).
-- 
Brian May <bam@snoopy.apana.org.au>


-- 
To UNSUBSCRIBE, email to debian-devel-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org