"vladimir m. bondarev" wrote:

Hello, suse-security.

i'm sorry to bother you with this question, but i've spent much time with this problem and haven't solved it yet.

so, the situation:

eth0 is connected to local network (vlan-29) (10.51.29.x) eth1 is connected to internet eth2 is connected to local network (vlan-30, vlan-31) (10.51.30.x and 10.51.31.x)

there is a very big lan and just one server connects it to internet. i need to count traffic for all ips in lan (vlan-29,30,31) that goes from server (10.51.29.50 for vlan-29, 10.51.30.10 for vlans-30,31) to users. i count web traffic with squid, but i also need to count icq (we're using socks for it) and mail (everybody have mailboxes on server) traffic. masq enabled only for chosen users (not so many), so i don't need to count ftp, irc traffic.

can anyone help me to solve this problem?

Hi Vlidimir, ipac (IP accounting) will solve your problems, the tarball (ipac-1.10.tar.gz) can be found at: http://linux.netsurf.de/files/console/adm/ Martin -- martin.peikert@innominate.com system engineer innominate AG clustering & security the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

* vladimir m. bondarev wrote on Fri, Nov 24, 2000 at 10:41 +0300:

Hello, suse-security.

i'm sorry to bother you with this question, but i've spent much time with this problem and haven't solved it yet.

so, the situation:

eth0 is connected to local network (vlan-29) (10.51.29.x) eth1 is connected to internet eth2 is connected to local network (vlan-30, vlan-31) (10.51.30.x and 10.51.31.x)

there is a very big lan and just one server connects it to internet. i need to count traffic for all ips in lan (vlan-29,30,31) that goes from server (10.51.29.50 for vlan-29, 10.51.30.10 for vlans-30,31) to users.

This means you will count traffic for 3 class C networks? Makes around 700 rules, needs some performance... I solved the account-per-ip problem with my firewall script. Here some snippets: ACC_RANGE="192.168.9:9-11 192.168.11:1-254 192.168.12:1-254" ipchains -N account ipchains -A input -j account function account_ip() { if [ "$ACC_IP_RETURN" = "no" ] ; then return="" else return="-j RETURN" fi for ip ; do ipchains -A account -s $ip -b $return done } function account_one_range() { net=$1; from=$2; to=$3; echo "--> Accountings from $net.$from to $net.$to" if [ "$to" = "" ] ; then echo "Account-range: paramtererror $@" exit fi #exit declare -i n n=$from while true ; do account_ip "$net.$n" n=$n+1; if [ "$n" -gt "$to" ] ; then return fi done } function account_ranges() { for range ; do net=`echo "$range" |awk -F':' '{ print $1; }'` ips=`echo "$range" |awk -F':' '{ print $2; }'` from=`echo "$ips" |awk -F'-' '{ print $1; }'` to=`echo "$ips" |awk -F'-' '{ print $2; }'` account_one_range $net $from $to done } account_ranges $ACC_RANGE; (Please note, taht here ipchains is a function. A shortened version could look like: function ipchains() { #the wrapper CMD="/sbin/ipchains $@" retcode=0 MESS=`$CMD 2>&1` || ( retcode=$? ; echo -ne '\a' ; # beep echo "** FATAL ** command FAILED #$retcode" ) if [ "$MESS" != "" ] ; then echo "** WARNING ** returned message:" echo "$MESS" fi return retcode; } I hope I haven't forgot another subfunction :) This script generates rules to log traffic into the "account" chain. Another script helps to get this data on disk (this version with english outputs :)): http://sws.dett.de/mini/account-ip/ Excerpt from documentation: | The data is stored persistent in /var/log/accountings | ($sum_file). | You should call this script often (i.e. once an hour) in quite | mode ($0 -q) to keep this file uptodate. Once a day (or week | or...) you could call it by cron without parameters to get a mail | (STDOUT) with the formated output and resolved hostnames. Maybe it helps you or somebody :) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.