netdev - Re: Packet per Second

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1197671513.5973.10.camel@andromache>
Date:	Sat, 15 Dec 2007 09:01:53 +1030
From:	Glen Turner <gdt@....id.au>
To:	Flávio Pires <flavio.defreitas@...il.com>
Cc:	netdev@...r.kernel.org, bridge@...l.org
Subject: Re: Packet per Second

On Fri, 2007-12-14 at 15:34 +0000, Flávio Pires wrote:

> Well, I work on an ISP and we have a linux box acting as a
> bridge+firewall. With this bridge+firewall we control the packet rate
> per second from each client and from our repeaters. But I can`t
> measure the packet rate per IP. Is there any tool for this?

The usual approach is to generate NetFlow records -- there are
a number of Linux tools for this. Collect them with a collector
(flow-tools being a common choice). Then have a Perl script
which reads the flow records, processes them whichever way you
desire, and drops the result into a rrdtool file (there are modules
for both reading the flow-tools data and outputing in the rrdtool
format). The rrdtool utilities have a limited range of graphs,
but there is a huge selection of graphing packages from other
authors for rrdtool-stored data (Drraw, etc).  Flow-tools also
has some third-party analysis tools, some of those have good
"top talker" statistics.

This is a lot of work, since you are really putting a complete
measurement infrastructure in place to get the one statistic
you desire.  But I'd encourage you to do that, since knowing
one statistic usually leads to further questions of the data.

-- 
Glen Turner, Senior Network Engineer
Australia's Academic & Research Network    www.aarnet.edu.au

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html