In an ISP type environment, where DHCP is used, IP addresses change too frequently to be of use. I think that what you're looking for a an IP accounting tool, which I'm sure is available for $$$ from vendors.
I think that the combination of micro_ntop w/ a mySQL database could do what you are looking for. Look at database/mySQLdefs.txt for the fields in the database. What you may have to do is to add a date/time stamp to the database and a thread to ntop to periodically dump & reset the data. If that's something of intere$t to you, let's talk off-list... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Lange Sent: Tuesday, April 23, 2002 5:22 PM To: [EMAIL PROTECTED] Subject: Re: [Ntop] total traffic over a period (was: Ntop Question) I'd like to chime in here and ask a similar related question. While MRTG is nice for making pretty graphs, it is not designed for actual "network accounting". I'm desperately looking for a tool that will run on a box and sniff the traffic on an interface counting total network traffic (in bytes) and summarizing it by destination IP which can then be used for billing purposes. We have many clients running (mostly web sites) on dedicated IPs who we need to bill for bandwidth usage on a monthly basis. I have yet to find a tool suitable for that purpose. Primary features that tend to be lacking in most tools I've looked at are: - data counters do not roll-over on a periodic basis. - data statistics do not survive the tool being restarted (or if it crashes constantly e.g. ntop ;) - data is grouped by connection pairs instead of being grouped by the IP addresses in your subnet. Probably some other things I'm not thinking of at the moment. If anyone has any suggestions, PLEASE let me know. Thanks. John On Friday 19 April 2002 09:31 am, you wrote: > I wouldn't say ntop isn't good for traffic counting, but rather that there > are other tools which are better if that's ALL you want/need to do. > > ntop is based on counting and analysis of the information visible on the > interface(s) of the host that ntop is executing on. Because ntop sees the > packet information (instead of just the snmp counts), ntop can and does do a > lot more with the information than simple counts. ntop also doesn't come > with the same types of canned reports that mrtg does - while the data can be > logged into a SQL database, with ntop you will have to create the reports > and graphs you need. > > If all you need is counts, ntop may be too "big" and complex. What mrtg > does is to use snmp to capture counters - packets, bytes, CPU usage, # of > processes, temperature, rainfall - ANYTHING that can be grabbed from an snmp > enabled device and puts those values into a log file. mrtg then reads the > files and generates browser pages showing the graphs. The beauty of mrtg is > that it can graph ANYTHING that can be captured. > > mrtg - like sFlow and NetFlow (which ntop supports) - acts as a central > station consolidating information from multiple sensors placed around a > network. The mrtg host doesn't even have to provide data (it can be a > workstation in the middle of the network, not a router). > > mrtg is well known - it's the tool that generates reports for most of the > internet backbones. And it comes preconfigured to do the kinds of graphs > you may be talking about. As to more information, I gave you two links in > the original message... For examples of mrtg in use, try these: > > http://www.crt.net/support.cfm > http://mrtg.netaxs.com/ > http://west-boot.mfnx.net/traffic/ > > -----Burton > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of > Boniforti Flavio > Sent: Friday, April 19, 2002 5:13 AM > To: [EMAIL PROTECTED] > Subject: R: [Ntop] total traffic over a period (was: Ntop Question) > > > > > > ntop focuses on what the traffic is. For pure traffic counts > > (so many bytes > > per unit) on specific interfaces (especially if you want to > > consolidate > > traffic from many points around a network), ntop may not be > > the best tool > > here - look at mrtg also. > > > > http://www.mrtg.org -> > > http://people.ee.ethz.ch/~oetiker/webtools/mrtg/ > > As far as I understand what you wrote, you're saying that NTOP is good > for traffic-monitoring, but not traffic-counting, right? > > So it should be used for gathering infos about WHAT traffic is being > done, like SMTP, HTTP and so on... > > You suggested the use of MRTG... Do you have any more clues about it? > Would you suggest it to be used for gathering periodical infos about the > amount of traffic passed through my HDSL connection??? > > Thanx in advance... > > > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listmanager.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listmanager.unipi.it/mailman/listinfo/ntop > > -- John Lange _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
