From owner-freebsd-questions@FreeBSD.ORG  Wed Dec 14 06:13:40 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 76F4016A41F
	for <freebsd-questions@freebsd.org>;
	Wed, 14 Dec 2005 06:13:40 +0000 (GMT) (envelope-from cswiger@mac.com)
Received: from pi.codefab.com (pi.codefab.com [199.103.21.227])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 01CD743D46
	for <freebsd-questions@freebsd.org>;
	Wed, 14 Dec 2005 06:13:39 +0000 (GMT) (envelope-from cswiger@mac.com)
Received: from localhost (localhost [127.0.0.1])
	by pi.codefab.com (Postfix) with ESMTP id 996426066;
	Wed, 14 Dec 2005 01:13:38 -0500 (EST)
Received: from pi.codefab.com ([127.0.0.1])
	by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 60586-09; Wed, 14 Dec 2005 01:13:37 -0500 (EST)
Received: from [192.168.1.3] (pool-68-161-122-227.ny325.east.verizon.net
	[68.161.122.227])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by pi.codefab.com (Postfix) with ESMTP id 8B6C95E80;
	Wed, 14 Dec 2005 01:13:37 -0500 (EST)
Message-ID: <439FB80C.4050905@mac.com>
Date: Wed, 14 Dec 2005 01:13:32 -0500
From: Chuck Swiger <cswiger@mac.com>
Organization: The Courts of Chaos
User-Agent: Mozilla Thunderbird 1.0.7 (Windows/20050923)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Parv <parv@pair.com>
References: <20051214000234.GA28630@holestein.holy.cow>
In-Reply-To: <20051214000234.GA28630@holestein.holy.cow>
X-Enigmail-Version: 0.93.0.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: amavisd-new at codefab.com
Cc: f-q <freebsd-questions@freebsd.org>
Subject: Re: Getting the network traffic amount since the interface went up
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Dec 2005 06:13:40 -0000

Parv wrote:
> I am interested to know the total amount of data passed through a
> network interface (em0 in my case) since the interface went up.  So
> far, i have seen that pload, nload, & "netstat -b -I" report the
> amount since the operating system has been up, not since the new
> ethernet connection has been (re)established.
> 
> Is there a way to find out the amount of traffic (in & out) since a
> network interface has been up (not since the OS has been up)?

There are lots of solutions to this problem, it kinda depends on what you're
trying to do.  You might set up an IPFW rule which matches just the traffic you
care about, and look at "ipfw -a l".  You can zero the counters at will if you
like, too.  From the ipfw manpage:

     Per-flow queueing can be useful for a variety of purposes.  A very simple
     one is counting traffic:

           ipfw add pipe 1 tcp from any to any
           ipfw add pipe 1 udp from any to any
           ipfw add pipe 1 ip from any to any
           ipfw pipe 1 config mask all

     The above set of rules will create queues (and collect statistics) for
     all traffic.  Because the pipes have no limitations, the only effect is
     collecting statistics.  Note that we need 3 rules, not just the last one,
     because when ipfw tries to match IP packets it will not consider ports,
     so we would not see connections on separate ports as different ones.

-- 
-Chuck