On Thu, 2008-08-28 at 16:03 +0000, Stuart Henderson wrote: > > > > Thanks for any ideas beyond pftop, tcpdump, hatched, darkstat and > > ntop ;) >
> the nfdump/nfprofile tools (also in ports) are interesting too, > there's a web interface NfSen which is yet to be ported but can > be manually installed without huge trouble. they need to work > with a collector; our low-overhead one (pfflowd) needs mending > to work with the changes to PF (hmm, now where did I put > canacar's diff for that...) but there is also pcap-based > softflowd which should be ok (I haven't tried it on the pflog > interface, but if it works, that's probably the best way to > use it, and if it doesn't work like that, it's relatively > easy to add). Thanks, I'll have a look into it. Maybe you could send me canacar's diff, so I can test it while I'm on it. I'd definitely prefer pfflowd over softflowd.
