Hi Matthias, In concept, and as documentation says, what you want to achieve is feasible and your understanding of the classifier() is correct - you only have to write down your own patterns: re-phrased, regular expressions are typically employed to recognize protocols but they can be of course used to recognize virtual hosts when in presence of text-based protocols (ie. HTTP, FTP or POP3).
As you said this is quite innovative and interesting - so let me know if i can support you somehow (feel also free to contact me privately). For now i have not received any feedback which can help you dimensioning the solution - so can't say how easy it would be to deploy in this sense; perhaps somebody reading can fill this gap? Cheers, Paolo On Tue, Feb 17, 2009 at 09:20:45PM +0100, Matthias Pigulla wrote: > > Dear all, > > I've recently set up pmacct for accounting and it works very well. However, > most of the traffic I'm seeing is HTTP for name-based virtual hosts. As the > page on classification says "traffic classification can result highly > beneficial for ... accounting and billing per application layer logical > entities (ie. virtual hosts)", I was wondering whether pmacct is capable of > sorting out traffic in my case. > > It would have to inspect the "Host:" header sent during the beginning of a > http connection and classify traffic as "http" + the host name following the > header. > > The README.developers file from the classifiers example files describes > char protocol[] = "<something>" > as a static value. As I understand it, when the classifier() function returns > 1, it means that the flow belongs to that protocol. I think in my case the > value would need to change with each successful classification. > > Do you think it would easily be possible to extend pmacct to reflect this? I > think it would be a great feature if one could measure IP traffic for virtual > hosts sharing an IP address. > > Thanks a lot! > Matthias _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
