*BSD News Article 66961


Return to BSD News archive

Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!news.mira.net.au!inquo!in-news.erinet.com!izzy.net!aanews.merit.net!imci3!imci4!newsfeed.internetmci.com!news.mathworks.com!fu-berlin.de!cs.tu-berlin.de!informatik.uni-bremen.de!nordwest.pop.de!uniol!uni-erlangen.de!news.tu-chemnitz.de!irz401!uriah.heep!news
From: j@uriah.heep.sax.de (J Wunsch)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: FreeBSD and network accounting
Date: 24 Apr 1996 22:18:36 GMT
Organization: Private FreeBSD site, Dresden
Lines: 21
Message-ID: <4lm9bs$s7o@uriah.heep.sax.de>
References: <4lgfmj$n64@narses.hrz.tu-chemnitz.de>
  <4ljd8j$ng0@uriah.heep.sax.de>
  <Pine.LNX.3.92.960424084114.105B-100000@benjy.csn.tu-chemnitz.de>
Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch)
NNTP-Posting-Host: localhost.heep.sax.de
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Newsreader: knews 0.9.6

Michael Hasenstein <mha@informatik.tu-chemnitz.de> writes:

>tcpdump is also useless, since it puts a device into promiscous mode,
>which makes the accounting files far too big. I can tell nacctd to only
>count packets that go through the router.

(Answered in private mail, since there was no indication that there's
also been a followup posting.)

Check out the filter rules.  It is possible with tcpdump, though it's
certainly different from the Linux approach.

You don't even need promiscous mode if the box itself acts as the
router.

-- 
cheers, J"org

joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE
Never trust an operating system you don't have sources for. ;-)