Re: Bandwidth consume by IP address
On 2010-10-02, Peter N. M. Hansteen wrote: > Hermes Ojeda Ruiz writes: > >> I'm working with a OpenBSD firewall on embedded hardware, and the client >> want to know the bandwidth consume by IP address. >> >> I don't know if this is possible using PF, another tool or making scripts to >> get the information. > > There are a few options available. One is to write the rule set with > labels to collect statistics, making sure the labels are one per IP > address. The other main option is to use pflow(4), with 'set > state-defaults pflow' or 'keep state (pflow)' for individual rules in > your rule set, set up a collector somewhere and extract the data you > need per IP address. If you go for pflow, the pflow man page will get > you started. pflow needs software to collect data; you might want to look at nfsen/nfdump, pmacct or flow-tools - all are in ports. (Note that pflow is compatible with Netflow).
Re: Bandwidth consume by IP address
man pflow On Fri, Oct 01, 2010 at 08:57:07PM -0500, Hermes Ojeda Ruiz wrote: > Hi, > > I'm working with a OpenBSD firewall on embedded hardware, and the client > want to know the bandwidth consume by IP address. > > I don't know if this is possible using PF, another tool or making scripts to > get the information. > > I'm worried about the performance, because, some weeks ago I make a question > in the list "How distribute bandwidth by IP's", and I solved it, using a lot > of cbq's by ip address (~150 ip address) like was recommended on the > replies, of course, using an script to generate it. That's work, perfect, > but generate some delays on the packets, and if I log everything it can make > the connection useless. The firewall is running in a Soekris net5501. > > Sorry, if this is a fool question, and my bad english. > > -- > Hermes Ojeda Ruiz
Re: Bandwidth consume by IP address
Hermes Ojeda Ruiz writes: > I'm working with a OpenBSD firewall on embedded hardware, and the client > want to know the bandwidth consume by IP address. > > I don't know if this is possible using PF, another tool or making scripts to > get the information. There are a few options available. One is to write the rule set with labels to collect statistics, making sure the labels are one per IP address. The other main option is to use pflow(4), with 'set state-defaults pflow' or 'keep state (pflow)' for individual rules in your rule set, set up a collector somewhere and extract the data you need per IP address. If you go for pflow, the pflow man page will get you started. I'd recommend taking a look at Michael W. Lucas' recent book for the Netflow analysis part, while the upcoming second edition of the Book of PF contains a bit of material about both approaches too (the first edition has only the labels part). - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ "Remember to set the evil bit on all malicious network traffic" delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.
Bandwidth consume by IP address
Hi, I'm working with a OpenBSD firewall on embedded hardware, and the client want to know the bandwidth consume by IP address. I don't know if this is possible using PF, another tool or making scripts to get the information. I'm worried about the performance, because, some weeks ago I make a question in the list "How distribute bandwidth by IP's", and I solved it, using a lot of cbq's by ip address (~150 ip address) like was recommended on the replies, of course, using an script to generate it. That's work, perfect, but generate some delays on the packets, and if I log everything it can make the connection useless. The firewall is running in a Soekris net5501. Sorry, if this is a fool question, and my bad english. -- Hermes Ojeda Ruiz
