From owner-freebsd-questions@FreeBSD.ORG  Thu Mar  4 08:38:18 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6B11A16A4CE
	for <questions@freebsd.org>; Thu,  4 Mar 2004 08:38:18 -0800 (PST)
Received: from mail1.acecape.com (mail1.acecape.com [66.114.74.12])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F0DF843D2D
	for <questions@freebsd.org>; Thu,  4 Mar 2004 08:38:17 -0800 (PST)
	(envelope-from lists@natserv.com)
Received: from p65-147.acedsl.com (p65-147.acedsl.com [66.114.65.147])
	by mail1.acecape.com (8.12.11/8.12.11) with ESMTP id i24GcHxB015665
	for <questions@freebsd.org>; Thu, 4 Mar 2004 11:38:17 -0500
Date: Thu, 4 Mar 2004 11:44:48 +0000 (GMT)
From: Francisco Reyes <lists@natserv.com>
X-X-Sender: fran@zoraida.natserv.net
To: FreeBSD Questions List <questions@freebsd.org>
Message-ID: <20040304114040.T11547@zoraida.natserv.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: Monitoring TCP/IP traffic
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Mar 2004 16:38:18 -0000

As of a few days ago my DSL modem activity light rarely ever goes inactive
for long.

I am looking for any program anyone could recommend to monitor what's
going on.

Yesterday I added log options to all my IPFW rules to see if I could find
anything suspicious. I added log options even to pass rules and the amount
of activity in the DSL modem seems much more than what is reported by
IPFW rules.

The machine in question is a 4.9 Stable (as of Dec 29) and it acts as a
gateway to my other machines.

Is there is anything like TOP for TCP/IP?
I saw ntop in ports, but it seems only analyzes LAN/internal subnet.