IP Traffic Accounting
Mon, 24 Jun 2002 12:41:14 -0400
On Mon, Jun 24, 2002 at 10:33:00AM -0500, Jason R. Martin wrote:
> > IPaudit will probably be quite ok for a Workstation providing Internet
> > connections to other home users or small office, if security on the
> > Internal interface is not a concern. Also, a standalone machine to
> > monitor traffic may be a simple setup, and performance may not be such
> > an issue for a small number of hosts when using a no-switch Hub.
You, of course, can use a switch and mirror all traffic to a port
where your NIDS or accounting application hangs off of.
> > Performance will not be hampered at all if you can get hold of an
> > ethernet bridging device.
> Yeah, using a hub would definitely not work for me. I run ipaudit directly
> on the firewall, where I have yet to see any sort of performance hit, even
> with roughly 800-1000 users. Every 30min I get a ~300k file. I'm working
> on ways of using the information through a MySQL database instead of the
> flat text files that ipaudit produces. We'll see if anything fun comes of
> that :-)