[plug] Track traffic on an aliased interface

[Ryan]

> On Thu, 16 Dec 2004 08:08:02 +1100
> Onno Benschop <onno at itmaze.com.au> wrote:
> 
> > I have eth0 aliased across three IP addresses - one to my satellite
> > link, one for local personal hardware and one for local other hardware.
> > 
> > I get billed for traffic across my satellite link, but ifconfig shows
> > all the traffic on eth0 and does not show traffic on eth0:1 and eth0:2.
> > 
> > How can I distinguish between the three?
> > 

> On Thu, 2004-12-16 at 10:11, bwarff wrote:
> afaik, the new kernel architecture on the 2.6 series no longer makes that information
> easily available - they all get aggregated as eth0. Best bet would probably be to use the ip networks to split the data out.
> eg: id assume your local stuff is 10.x.x.x or 192.168.0.x ... it should be easy enough to script
> those ip ranges away.

Could you use some basic iptables rules to log traffic to/from the
aliased addresses?  Then you can see the counts with "iptables -vL" 
they don't wrap at ~2GB either!  I once did this to certain traffic on a
wireless gateway with far too many aliased interfaces (read dodgy
router) many moons ago, worked well for me.

If you already have a firewall setup it is already counting, just add a
few more specific rules.  If the box has no firewall and is already set
to allow everything, you can just make rules allowing what you want to
count and that should do it.

If you then wanted to graph it, some simple shell magic of the iptables
-vL output called from mrtg will work fine.

Ryan