From owner-freebsd-isp Mon Oct 7 14:46:57 1996 Return-Path: owner-isp Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id OAA02118 for isp-outgoing; Mon, 7 Oct 1996 14:46:57 -0700 (PDT) Received: from bitbucket.edmweb.com (bitbucket.edmweb.com [204.244.190.9]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id OAA02108 for ; Mon, 7 Oct 1996 14:46:51 -0700 (PDT) Received: (from steve@localhost) by bitbucket.edmweb.com (8.6.12/8.6.12) id OAA00278; Mon, 7 Oct 1996 14:46:23 -0700 Date: Mon, 7 Oct 1996 14:46:18 -0700 (PDT) From: Steve Reid To: Dev Chanchani cc: freebsd-isp@FreeBSD.org Subject: Re: BPF In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-isp@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk > My understanding is that reading from the bpf device gives you a raw dump > of the data over the network. > You will have a bpf header (18 bytes?) > Then I need to know the ip_offset for packets comming > in over the ed1 network interface so I can start calculating > how much traffic is going to what address based on the ip header. The usuall way to keep track of traffic is to use IP accounting. Any FreeBSD machine can be set up to keep track of how much data it is sending/receiving to/from any address/port. Look at the man page for ipfw if you haven't already. If you're trying to use a promiscious-mode FreeBSD machine to do accounting for machines that don't have IP accounting facilities, then what you're doing kinda makes sense... But, I think it probably would still be better to use the existing IP accounting facilities if possible... Is it possible to do IP accounting for other machines on the network, if the interface is in promiscous mode? Can it be done with a kernel hack? Sorry I can't answer your question, but the idea of using bpf to do IP accounting doesn't seem quite right to me. (But what do I know? I haven't looked at those parts of the kernel.) ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve@edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)