From owner-freebsd-net@FreeBSD.ORG  Tue Feb 24 06:43:27 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 073FC16A4CF
	for <freebsd-net@freebsd.org>; Tue, 24 Feb 2004 06:43:27 -0800 (PST)
Received: from juergen.edv-winter.de (juergen.edv-winter.de [195.226.65.65])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4FBCB43D1F
	for <freebsd-net@freebsd.org>; Tue, 24 Feb 2004 06:43:25 -0800 (PST)
	(envelope-from ar@g23.org)
Received: from localhost (localhost [127.0.0.1])
	by juergen.edv-winter.de (8.12.10/8.12.9) with ESMTP id i1OEgcST096796
	for <freebsd-net@freebsd.org>; Tue, 24 Feb 2004 15:42:48 +0100 (CET)
	(envelope-from ar@g23.org)
Date: Tue, 24 Feb 2004 15:42:38 +0100 (CET)
From: Andre Rein <ar@g23.org>
X-X-Sender: ar@juergen.edv-winter.de
To: freebsd-net@freebsd.org
Message-ID: <20040224152136.S97179@juergen.edv-winter.de>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: different traffic accounting trafd vs. ipcad
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Feb 2004 14:43:27 -0000

Hi ML,

I'm running two different accounting programs at the firewall (ipcad &
trafd) and it looks like that trafd doesn't account the whole traffic,
because the sum of the individual tcp/udp/icmp traffic doesn't match the
ipcad accounting.

There are differences in between 0-50 MB a day. One time trafd accounts
more outgoing traffic than ipcad but the incoming is much lesser.
If I compare the accounting from our local provider with the ipcad traffic
I get nearly the same results.
So it must be trafd or a wrong config i did.


So my question, does anybody run into the same trouble with trafd and
solved it or is there any other Software wich can count port based traffic
and is more documented and tested?


here some network/trafd related stuff:

processes:

/bin/trafd -r -O -i fxp0
/sbin/natd -l -a 195.226.65.125 -unregistered_only

nic's:
fxp0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
   inet 192.168.55.74 netmask 0xfffffffc broadcast 192.168.55.75
   inet6 fe80::260:b0ff:fe67:e801%fxp0 prefixlen 64 scopeid 0x1
   ether 00:60:b0:67:e8:01
   media: Ethernet autoselect (100baseTX <full-duplex>)
   status: active
fxp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
   inet 195.226.65.125 netmask 0xffffffc0 broadcast 195.226.65.127
   inet6 fe80::290:27ff:fe22:b7e8%fxp1 prefixlen 64 scopeid 0x2
   ether 00:90:27:22:b7:e8
   media: Ethernet autoselect (100baseTX <full-duplex>)
   status: active

Routing tables:

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.55.73      UGSc       28 96501173   fxp0
......



kind regards

-- 

"And some greetings from the Toaster"