From owner-freebsd-questions Thu Nov 30 20:16:33 2000 Delivered-To: freebsd-questions@freebsd.org Received: from hindenburg.eboai.org (hindenburg.eboai.org [206.183.134.245]) by hub.freebsd.org (Postfix) with ESMTP id 04C8937B400 for ; Thu, 30 Nov 2000 20:16:31 -0800 (PST) Received: by hindenburg.eboai.org (Postfix, from userid 1000) id 7145E3DA0; Thu, 30 Nov 2000 23:16:29 -0500 (EST) Date: Thu, 30 Nov 2000 23:16:29 -0500 From: Chip Marshall To: Joe Oliveiro Cc: freebsd-questions@freebsd.org Subject: Re: Network monitoring Message-ID: <20001130231629.A76863@setzer.chocobo.cx> Reply-To: chip@chocobo.cx References: <20001129181422.A60319@setzer.chocobo.cx> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.1.4i In-Reply-To: ; from joe@advancewebhosting.com on Wed, Nov 29, 2000 at 10:19:20PM -0500 X-URL: http://www.chocobo.cx/chip/ X-OS: FreeBSD 3.4-RELEASE i386 up 259 days, 23:42 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On November 29, 2000, Joe Oliveiro sent me the following: > Will ipfw count ips not binded to the box? > > > One of the tricks I've used to do this sort of thing in the past is to > > setup and ipfw rule for each ip address you want to monitor. By using > > ipfw count rules, you can get a count of the number of packets and > > number of bytes matching each rule, then you just need a script to > > check this from time to time and record it. Yeah, they're counted as the packets flow through the router, so as long as the traffic goes into the machine, it will be counted. Note: Make sure you specify only one direction for the count, else you'll get double the expected number (ipfw is applied once when packets come in, and again when they leave.) -- Chip Marshall http://www.chocobo.cx/chip/ Finger for PGP GCM/CS d+(-) s+:++ a18>? C++ UB++++$ P+++$ L- E--- W++ N+@ o K- w O M+ V-- PS PE Y? PGP++ t+@ 5 X R>+ tv+() b++>+++ DI++++ D(-) G++ e>++ h!>++ r-- y- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message