*BSD News Article 66985


Return to BSD News archive

Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!news.cs.su.oz.au!metro!metro!munnari.OZ.AU!news.ecn.uoknor.edu!news.cis.okstate.edu!newsfeed.ksu.ksu.edu!lazrus.cca.rockwell.com!newssvr.cacd.rockwell.com!newsrelay.iastate.edu!vixen.cso.uiuc.edu!howland.reston.ans.net!blackbush.xlink.net!ka.sub.net!netland.inka.de!stiller.netland.inka.de!br
From: br@netland.inka.de (Bernd Rosauer)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: FreeBSD and network accounting
Date: 26 Apr 1996 16:35:30 +0200
Lines: 22
Message-ID: <br.830529262@stiller.netland.inka.de>
References: <4lgfmj$n64@narses.hrz.tu-chemnitz.de> <4ljd8j$ng0@uriah.heep.sax.de> <Pine.LNX.3.92.960424084114.105B-100000@benjy.csn.tu-chemnitz.de>
NNTP-Posting-Host: stiller.netland.inka.de
X-Newsreader: NN version 6.5.0 #1 (NOV)

Michael Hasenstein <mha@informatik.tu-chemnitz.de> writes:

>On 23 Apr 1996, J Wunsch wrote:

>> [...]
>> RTFM ipfirewall(4), ipaccounting(4), ipfw(8).

>We DO know that, but it's useless, since we need to save the output of
>nacctd to disc, i.e. each connection, for that we can trace problems
>later. We use a second (linux)firewall which does this, and we get a 500KB
>file each day representing >1GB of outgoing traffic from the student
>network. The second router is used for the other half of our network.

>tcpdump is also useless, since it puts a device into promiscous mode,
>which makes the accounting files far too big. I can tell nacctd to only
>count packets that go through the router.

Ask felix@sub.net.  He wrote a configurable IP accounting package
for BSD/OS.  The German ISP 'sub-Netz' uses it for their accounting
system.

-Bernd