Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 1080 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Traffic accounting for single IPs possible?

asc
Hello!

Is it possible to let ASL 4.017 generate a report including the traffic for every single internal IP without listing all internal machines' IP addresses in the "Queried networks" (Reporting->Accounting) Listbox? I don´t want to define 238 "networks" for all our hosts.

Is there an easy solution for this?

Thanks in advance,
Alexander  


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to cyclops
    Hi again!

    I found a solution that satisfies me. It´s really not that accurate but it spits out some figures for the bosses:

    The accounting scripts produce a file called /var/log/accounting/DATE.gz. I think it contains source and destination ips, ports and the traffic in bytes. The following line does the trick for me:

    smitsfvw001:/var/log/accounting # zcat /var/log/accounting/2003-12-18.gz | grep 172.25.10.100 | awk 'BEGIN { i=0 } ; $7 > 0 { i=i+$7 } END { i=i/1024/1024 ; print i " MB" }'
    0.22238 MB

    But be aware:
    - Accounting enabled on the external interface produces NATed ips - so use the internal interface.
    - Pakets which are dropped by the firewall will get into your calculation. So you need to filter the accounting-data as good as possible before calculating (remove broadcasts and stuff..).

    Just my two cents.

    Alexander