From owner-freebsd-isp  Mon Jul  7 20:16:50 1997
Return-Path: <owner-isp>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id UAA24142
          for isp-outgoing; Mon, 7 Jul 1997 20:16:50 -0700 (PDT)
Received: from panda.hilink.com.au (panda.hilink.com.au [203.8.15.25])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id UAA24133
          for <freebsd-isp@FreeBSD.ORG>; Mon, 7 Jul 1997 20:16:45 -0700 (PDT)
Received: (from danny@localhost)
	by panda.hilink.com.au (8.8.5/8.8.5) id NAA26395;
	Tue, 8 Jul 1997 13:16:29 +1000 (EST)
Date: Tue, 8 Jul 1997 13:16:27 +1000 (EST)
From: "Daniel O'Callaghan" <danny@panda.hilink.com.au>
To: Adam David <adam@veda.is>
cc: freebsd-isp@FreeBSD.ORG
Subject: Re: per-user IP accounting
In-Reply-To: <199707080115.BAA03952@ubiq.veda.is>
Message-ID: <Pine.BSF.3.91.970708131324.869j-100000@panda.hilink.com.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-isp@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


On Tue, 8 Jul 1997, Adam David wrote:

> What are people using to log IP traffic on a per-user basis?

I'm not, but if I were, I would add ipfw rules using ip-up in pppd, and 
do the accounting in ip-down.
I use ipfw for network IP accounting.  Define a particular rule number 
for a given accounting entity.

I have also written a program which does accounting based on IP 
addresses, by listening to bpf like tcpdump.  It does not require the 
prior definition of the IP addresses to be watched, the way ipfw does.

Danny