From owner-freebsd-isp@FreeBSD.ORG  Fri May 26 18:35:54 2006
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
X-Original-To: freebsd-isp@freebsd.org
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DB2D816AEFA
	for <freebsd-isp@freebsd.org>; Fri, 26 May 2006 18:35:54 +0000 (UTC)
	(envelope-from jjirsa@hmc.edu)
Received: from 2advanced.com (2advanced.com [216.174.103.13])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8EA7343D72
	for <freebsd-isp@freebsd.org>; Fri, 26 May 2006 18:35:54 +0000 (GMT)
	(envelope-from jjirsa@hmc.edu)
Received: from JJirsa (cartman.2advanced.net [216.174.103.7])
	by 2advanced.com (8.12.9/8.12.9) with ESMTP id k4QIZjop021784
	for <freebsd-isp@freebsd.org>; Fri, 26 May 2006 11:35:45 -0700
From: "Jeff Jirsa \(HMC\)" <jjirsa@hmc.edu>
To: <freebsd-isp@freebsd.org>
Date: Fri, 26 May 2006 11:35:51 -0700
Message-ID: <007401c680f3$36e3e0f0$a001a8c0@2advanced.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <44774502.7060303@wilkshire.net>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
Thread-Index: AcaA8G8I/bQXMVtfQd+gHIjGK0mj9QAAdnEA
Subject: RE: bandwidth monitoring
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 26 May 2006 18:36:07 -0000

Steve Ames wrote:
> ntop would work if its actually a hub. ntop would work with a switch
> also but you'd have to tell the switch to make sure that your BSD
> box gets a copy of all traffic.

You can use ntop's netflow collector in conjunction with netflow-enabled
switches to avoid spanning all of the traffic to the BSD box. That way,
you're only getting a few UDP streams instead of a copy of all traffic
crossing the switch - much easier to handle.

We use that combination to collect data, then dump at regular intervals into
a database for accounting/billing.

- J

-- 
Jeff Jirsa
jjirsa@2advanced.net
Senior Network Engineer
2advanced.net: Precision Hosting Platform