[pmacct-discussion] Checking to see if I understand this right

[Jim Archer]

Hi All...

I discovered pmacct a few weeks ago when I was looking for a solution to do 
IP based billing for my customers.  I have read what I could find on 
pmacct, including a white paper.

I just want to see if I understand this correctly, and ask a few simple 
questions.

It seems that periodically, pmacct puts an interface into promiscuous mode 
and samples what it sees passing, adding this information to a database in 
memory or on disk. It builds a database and also can produce sflow output 
fromt he data it collects. From what I read, it does this 
semi-periodically, introducing an element of randomness in the timing. 
Data kept includes source and destination IPs and ports.

I understand that it can also aggregate netflow and sflow data streams from 
other devices, but I don't have any of those and would probably use it to 
collect data for analysis and generate sflow for something like ntop.

Do I have this right?  If so, here are my questions.

if the interface held in promiscuous mode, or switched in and out of it for 
sampling?

Approximately how often does pmacct sample?

How long is a typical sample?

How much performance impact is there?

I ask these questions because I use Vyatta routers and need a way to bill 
my customers for the bandwidth they consume.  I was thinking of billing at 
a reduced rate for data which crosses my routers but does not transit out 
to the Internet.

Also, I need to do 95th percentile billing.  Typically, this method is 
based upon samples taken about every 5 minutes.  I was thinking I could 
simply query the database to produce this data and billing.  I saw on the 
mail list archive this topic has been discussed, but there didn't seem to 
be a conclusion.

I would appreciate any comments.

Thanks!

Jim


         

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists