>> I am curious about this, because I wrote a simple tool to analyze traffic
>> -- and I want to be able to also analyze traffic to network address
>> aliases and traffic going through the gateway (by IP). 9I guess i should
>> have a closer look at where mrtg or snmp gets this info.) Here is an
>> example report:  
>> http://www.reedmedia.net/software/analyze_interface_bytes/example-20011010.txt
>> (I plan on changing the name.)

it looks to me like whatever supports this is doing periodic polls of
the totals from, eg, netstat -ib, and then computing deltas.  note
that it only names eth0 and eth1, not subinterfaces or aliases.

i think that to do by-alias accounting, you'll need to use ipf.
unfortunately, the last time i tried this, i found that a pass line
didn't log and a log line didn't pass, so i had to do both.

>I'm not sure if it'll do what you need, but have you tried the nmap package
>from pkgsrc/net ?

i don't think that'll help in this situation.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."