Using Gentoo to monitor traffic

scubacuda · Tux's lil' helper Joined: 05 Dec 2004 Posts: 111

I'd like to set up a Gentoo box to help me figure out how a campus environment is utilizing bandwidth (in layers 4-7). I'm not sure what exactly needs to be done, but I'm assuming it's somewhere along the lines of creating some sort of layer 7 bridge.

Ideally, it wouldn't be a bridge at all, but rather a box with an IP that I have plugged into a switch that has "port mirror" (in Cisco Catalyst talk) enabled on that port. That way, my box gets a copy of whatever else is floating on the network (similar to how they set up a proxies like SurfControl, etc).

Any input?
_________________
If my post was helpful to you, donate $1 to Gentoo.

pilla · Posted: Tue Feb 14, 2006 2:41 am Post subject:

Moved from Off the Wall to Networking & Security.
_________________
"I'm just very selective about the reality I choose to accept." -- Calvin

sloof3 · Tux's lil' helper Joined: 09 Sep 2004 Posts: 75

Might look into this: http://l7-filter.sourceforge.net/L7-HOWTO-Netfilter
I don't know much about it but it seems like the right direction.

Akhouk · Posted: Tue Feb 14, 2006 7:30 am Post subject:

If you want to monitor the traffic in and out of the campus network you could stick your Gentoo machine with two LAN cards and make them an ethernet bridge. You could then use iptables to count packet types.

You could use something like Cacti for drawing nice graphs. You would have to make a custom script for cacti to count the packets from iptables but once you have done that it would be easy to create different graphs and to manage them.
_________________
AMD 64 3500+, 2Gb RAM DDR400, 2 x 180Gb SATA, 256Mb Nvidia