From owner-freebsd-questions  Sun Jan  4 21:41:04 1998
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id VAA04788
          for questions-outgoing; Sun, 4 Jan 1998 21:41:04 -0800 (PST)
          (envelope-from owner-freebsd-questions)
Received: from blacksun.net.au (blacksun-gw.blacksun.net.au [202.21.8.125])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id VAA04779
          for <questions@freebsd.org>; Sun, 4 Jan 1998 21:40:58 -0800 (PST)
          (envelope-from ahill@blacksun.net.au)
Received: from blacksun.net.au (darkstar.blacksun.net.au [203.63.50.1])
	by blacksun.net.au (8.8.5/8.8.5) with SMTP id QAA12294
	for <questions@freebsd.org>; Mon, 5 Jan 1998 16:00:49 +1100 (EST)
Date: Mon, 5 Jan 1998 16:00:48 +1100 (EST)
From: Anthony Hill <ahill@blacksun.net.au>
To: questions@freebsd.org
Subject: Traffic accounting and stats.
Message-ID: <Pine.BSF.3.95q.980105154353.12245A-100000@blacksun.net.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

I am using 2.2.1-RELEASE as a router to route between my ~15 host
LAN and the async ppp link to my ISP. I would like to get detailed traffic
stats for each host on the network.

ie. how much traffic went from LAN machine A to LAN machine B. How much
went from LAN machine C out over the ppp link. How much traffic came
in over the ppp link to LAN machine D. etc etc.

Any idea how to go about this ?

It would also be REALLY cool if I could tell what the composition of the
traffic was. ie 50% of the externally sourced traffic destined for LAN
machine E was TCP on port 80, and the rest was TCP on port 23.

Please reply to this email address, as I dont have access to news, and
I dont contribute enough to warrant a subscription to the mailing list.

thanks,

Anthony Hill
Network Engineer
connect.com.au