On Wed, 10 Oct 2001, Andrew Brown wrote:

> >> I am curious about this, because I wrote a simple tool to analyze traffic
> >> -- and I want to be able to also analyze traffic to network address
> >> aliases and traffic going through the gateway (by IP). 9I guess i should
> >> have a closer look at where mrtg or snmp gets this info.) Here is an
> >> example report:  
> >> http://www.reedmedia.net/software/analyze_interface_bytes/example-20011010.txt
> >> (I plan on changing the name.)
> 
> it looks to me like whatever supports this is doing periodic polls of
> the totals from, eg, netstat -ib, and then computing deltas.  note

Exactly. One simple sh/awk tool to grab the "netstat -ib" (under BSD or
/proc/net/dev under Linux) info via cron. Then the second tool uses that
logged info to figure out the changes and tries to report this data.

> that it only names eth0 and eth1, not subinterfaces or aliases.

It could easily report the aliases as long as the tool to "log" it could
do it.

I wonder what the benefit of having netstat report the same amounts for
the aliases and the Link itself. Was there ever a time where any BSD
collected different information?

Should this be mentioned in the manual page?

Should this be considered a bug?

> i think that to do by-alias accounting, you'll need to use ipf.
> unfortunately, the last time i tried this, i found that a pass line
> didn't log and a log line didn't pass, so i had to do both.

Thanks for the hints, Andrew.

> >I'm not sure if it'll do what you need, but have you tried the nmap package
> >from pkgsrc/net ?
> 
> i don't think that'll help in this situation.

Because I said "analyze traffic" instead of stating I justed want to
report on the bytes transferred.

   Jeremy C. Reed
   http://www.reedmedia.net/