monitoring traffic usage on x.x.x.x/mask

[seccentral]

Hi, i recently(today) heard about this open source solution while looking for some means to monitor the traffic per ip on a gateway router running linux.

So i got the virtual appliance, deployed in vsphere but got a lil dazed by it's complexity.

My goal is to monitor traffic in/out (not graph the speeds, but log the total data in bytes/mbytes etc, for a vps project that has customers limited to specific sizes: for example: 1000GB/month etc)

Basically from what i've seen so far this project is in theory something similar to nagios. more or less. anyway that's not the point here.

On a linux router that i install zabix, can i monitor the total/in/out traffic that passes through that router but specific to a network/mask filter ?
and get the statistics per each and every one ip address from within that ip network ?

So far i've tried bandwidthd, ntop, darkstat but i'm always exploring alternatives.

[BDiE8VNy]

One way could be to use iptables.

This is only an example to show the idea and should not be considered as a ready-to-use solution.

First a new chain "traffic-monitor-net1" is created which gets all the traffic that is forwarded from the network 192.168.1.0/24.
Then a rule that only matches traffic coming from the address 192.168.1.42 is added to the new chain.

[root@router ~]# iptables -N traffic-monitor-net1
[root@router ~]# iptables -A FORWARD -s 192.168.1.0/24 -j traffic-monitor-net1
[root@router ~]# iptables -A traffic-monitor-net1 -s 192.168.1.42
[root@router ~]#

Now the bytes forwarded from 192.168.1.42 will be counted an can be monitored.

[root@router ~]# iptables -L traffic-monitor-net1 -vnx
Chain traffic-monitor-net1 (1 references)
    pkts      bytes target     prot opt in     out     source               destination         
    5025 1099511691257            all  --  *      *       192.168.1.42          0.0.0.0/0           
[root@router ~]#

One way to parse the output for transferred bytes could look like this

[root@router ~]# iptables -L traffic-monitor-net1 -vnx | awk '$7=="192.168.1.42"{print $2}'
1099511699843
[root@router ~]#

and can finally be used in a user parameter

# Example for key: iptables.traffic.out["traffic-monitor-net1", "192.168.1.42"]
UserParameter=iptables.traffic.out[*],/bin/sudo /sbin/iptables -L $1 -vnx | awk '$$7=="$2"{print $$2}'

[gavind]

How about installing a program like iftop here, would it still work?