From owner-freebsd-net@FreeBSD.ORG  Thu Sep 18 11:14:26 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 932FD16A4B3; Thu, 18 Sep 2003 11:14:26 -0700 (PDT)
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id AF80343FBF; Thu, 18 Sep 2003 11:14:25 -0700 (PDT)
	(envelope-from robert@fledge.watson.org)
Received: from fledge.watson.org (localhost [127.0.0.1])
	by fledge.watson.org (8.12.9/8.12.9) with ESMTP id h8IIEOgL002131;
	Thu, 18 Sep 2003 14:14:24 -0400 (EDT)
	(envelope-from robert@fledge.watson.org)
Received: from localhost (robert@localhost)h8IIENWh002128;
	Thu, 18 Sep 2003 14:14:24 -0400 (EDT)
Date: Thu, 18 Sep 2003 14:14:23 -0400 (EDT)
From: Robert Watson <rwatson@FreeBSD.org>
X-Sender: robert@fledge.watson.org
To: Josef Karthauser <joe@FreeBSD.org>
In-Reply-To: <20030918123203.GC13474@genius.tao.org.uk>
Message-ID: <Pine.NEB.3.96L.1030918141239.1604C-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: freebsd-net@FreeBSD.org
Subject: Re: Traffic analysis ports?
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Sep 2003 18:14:26 -0000


On Thu, 18 Sep 2003, Josef Karthauser wrote:

> I'm looking for some software to basically analyse the traffic I've got
> going over a particular pipe so that I can work out whether or what to
> traffic shape.  Can anyone recommend anything? 

I tend to cut my own BPF-based tools as needed to measure particular types
of traffic, but that's not a very scalable approach.  There are commercial
products, such as NAI's Sniffer tool (I think it can read playback from
pcap output), which claim to be able to help with that sort of analysis,
but I've never really used them.  For a "first cut" visualization of
currently active network connections, tools such as ntop, trafshow,
tcpstat, etc, can actually provide surprising amounts of insight.

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert@fledge.watson.org      Network Associates Laboratories