<html><head></head><body>I'll dig around to see if I still have some code. I wrote a program years ago to analyse netflow stats for pretty much the same purpose.<br>
<br>
Regards,<br>
<br>
Euan<br><br><div class="gmail_quote">On 25 February 2016 10:09:42 am AWST, Andrew Furey <andrew.furey@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><div><div>Hmm, I can probably get what I need with netflow, which I'll do with a dedicated VM rather than a physical (which already does other stuff). Looks like I'll have to reimplement the grab-stats-from-raw-numbers by hand though, as it'll be different to the simple iptables counter method from all of the others. What overkill...<br /><br /></div>Anyone have any cheat sheets in that regard? I remember doing a little bit of netflow stuff years ago (hi Jeremy).<br /><br /></div>Andrew<br /></div><div class="gmail_extra"><br /><div class="gmail_quote">On 24 February 2016 at 13:40, Balasubramaniam Natarajan <span dir="ltr"><<a href="mailto:bala150985@gmail.com" target="_blank">bala150985@gmail.com</a>></span> wrote:<br /><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi Andrew,<br /><br /></div>Shouldn't xplico or netflow do the trick since you are using a separate machine
for listening to the traffic ?<br /></div><div class="gmail_extra"><br /><div class="gmail_quote"><div><div class="h5">On Wed, Feb 24, 2016 at 8:27 AM, Andrew Furey <span dir="ltr"><<a href="mailto:andrew.furey@gmail.com" target="_blank">andrew.furey@gmail.com</a>></span> wrote:<br /></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi all, long time no post...<br /><br />I have an existing Linux firewall router with two network interfaces - eth0 (LAN) and eth1 (public IP). I'm using iptables rules to divert all traffic to a "traffic" chain, and then rules like the following:<br /><br />iptables -A traffic -i eth0 -s 192.168.0.1<br />iptables -A traffic -o eth0 -d 192.168.0.1<br /><br />I can then do "iptables -L traffic -v -x -n -Z" to get figures for packet and byte count on those matching rules, which I then parse and script to get data files for MRTG
to read.<br /><br />End result, I get an MRTG graph for bidirectional network traffic for 192.168.0.1. I can also add other rules with more specific iptables flags, combining multiple rules, etc to get any traffic graph I want. All so far so good for the last 7-odd years.<br /><br />Now the tricky bit; the powers that be are planning to replace the custom machine with Fortigate routers (90Ds in HA mode, if it matters). I've already logged a support ticket with Fortinet and confirmed that their system has no way to get those sorts of stats other than a simple total-data-on-network-interface count (largely due to all of their rules needing to have a target, so it can't just pass through for incrementing stats alone).<br /><br />I was hoping to set up a separate machine listening to the traffic, just for the stats side. I've set up port mirroring on the switch, to mirror the router's LAN port into an unused network port on another, and by turning promiscuous mode on I
can see the traffic in tcpdump, iftop, ifconfig counters, etc.<br /><br />HOWEVER it doesn't hit any iptables rules that I've tried; a thread on netfilter-devel seems to indicate that it's because it's not actually routing THROUGH the machine (<a href="http://osdir.com/ml/security.firewalls.netfilter.devel/2002-11/msg00160.html" target="_blank">http://osdir.com/ml/security.firewalls.netfilter.devel/2002-11/msg00160.html</a>). In that vein I was also trying fancy things with the TEE target etc, but still no luck.<br /><br />Has anyone ever done this before? If there's a simple method to get the numbers another way, I'm all ears (the parsing of figures for MRTG is a custom script of mine so I can do most anything), but I don't think analysing PCAP files every 5 minutes will be very productive. Nor did I really want to lose 50+ occasionally-very-useful graphs...<br /><br />TIA<span><font color="#888888"><br />Andrew<br /><br />-- <br /></font><div><font
color="#888888">Linux supports the notion of a command line or a shell for the same<br />reason that only children read books with only pictures in them.<br />Language, be it English or something else, is the only tool flexible<br />enough to accomplish a sufficiently broad range of tasks.<br /> -- Bill Garrett</font></div>
</span></div>
<br /></div></div>_______________________________________________<br />
PLUG discussion list: <a href="mailto:plug@plug.org.au" target="_blank">plug@plug.org.au</a><br />
<a href="http://lists.plug.org.au/mailman/listinfo/plug" rel="noreferrer" target="_blank">http://lists.plug.org.au/mailman/listinfo/plug</a><br />
Committee e-mail: <a href="mailto:committee@plug.org.au" target="_blank">committee@plug.org.au</a><br />
PLUG Membership: <a href="http://www.plug.org.au/membership" rel="noreferrer" target="_blank">http://www.plug.org.au/membership</a><span class="HOEnZb"><font color="#888888"><br /></font></span></blockquote></div><span class="HOEnZb"><font color="#888888"><br /><br clear="all" /><br />-- <br /></font><div><font color="#888888"></font><div dir="ltr"><font color="#888888"></font><div><font color="#888888"></font><div dir="ltr"><font color="#888888">Regards,<br />Balasubramaniam Natarajan<br /><a href="http://blog.etutorshop.com" target="_blank">http://blog.etutorshop.com</a><br /><a href="https://www.youracclaim.com/user/balasubramaniam-natarajan" target="_blank">https://www.youracclaim.com/user/balasubramaniam-natarajan</a><br /></font></div></div></div></div>
</span></div>
</blockquote></div><br /><br clear="all" /></div></blockquote></div></body></html>