From owner-freebsd-net@FreeBSD.ORG  Sun Jun 18 18:21:57 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D9CA916A47A
	for <freebsd-net@freebsd.org>; Sun, 18 Jun 2006 18:21:57 +0000 (UTC)
	(envelope-from regnauld@macbook.catpipe.net)
Received: from macbook.catpipe.net (x0.dk [62.242.165.154])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7410D43D45
	for <freebsd-net@freebsd.org>; Sun, 18 Jun 2006 18:21:57 +0000 (GMT)
	(envelope-from regnauld@macbook.catpipe.net)
Received: by macbook.catpipe.net (Postfix, from userid 1001)
	id D89D8CD692; Sun, 18 Jun 2006 20:21:51 +0200 (CEST)
Date: Sun, 18 Jun 2006 20:21:51 +0200
From: Phil Regnauld <regnauld@catpipe.net>
To: Brian Candler <B.Candler@pobox.com>
Message-ID: <20060618182151.GB2627@catpipe.net>
References: <4495530f.265f68ff.360d.48fa@mx.gmail.com>
	<20060618142644.81731.qmail@web36304.mail.mud.yahoo.com>
	<20060618180951.GA37133@uk.tiscali.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20060618180951.GA37133@uk.tiscali.com>
X-Operating-System: Darwin 8.6.1 i386
Organization: catpipe Systems ApS
User-Agent: Mutt/1.5.11
Cc: freebsd-net@freebsd.org, Nash Nipples <trashy_bumper@yahoo.com>
Subject: Re: Simple LAN IP accounting
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 18 Jun 2006 18:21:57 -0000

Brian Candler (B.Candler) writes:
> 
> Another approach is to capture absolutely everything using libpcap into a
> userland process, and then post-process afterwards.

	ports/net/ipfm - been using it for some years now.


> Another approach is to use statistical sampling - pick packets at random, so
> that overall you capture, say, 1 packet in 128, and analyse those. This is
> the approach used by sflow.

	One can also achieve this using good old netflow -- there's a boatload
	of netflow collectors -- and probes as well, see ng_netflow.

> very efficient way of doing this analysis. You can turn the sflow data into
> simple CSV records using 'sflowtool', or ntop has an sflow module.

	Ntop just seems very unreliable and bloated to me, at least after
	version 1.  Has it changed ?

> This assumes that taking the sampled data and multiplying it by 128 will be
> sufficiently accurate for your purposes, of course.

	+/- 2% according to some large ISPs who use it, which is apparently
	considers acceptable.