I'm soon going to be setting up a Soekris box as a gateway machine.  
For various reasons, I'm contemplating bridging the three interfaces 
together.  I see from the man pages that I can use ipf with the bridge, 
which is good; can I use pkgsrc/net/ntop to measure which machines are 
sending/receiving how much traffic?  If it matters, I'll probably be 
running -current on it.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb