Is it possible to show traffic (byte) accouning per local source ip

[johnpoz]

If your looking to just troubleshoot who is using what NOW for example you could use the darkstat package as well..

You could leave it running, but it doesn't reset per day, etc. But very easy way to find your top talkers for sure. Or what specific IPs have moved since you fired up darkstat

[bingo600]

Thanx Steve

I already have NtopNG running , but the ip accounting is not as easy as with bwd.

I have started bwd on "Lan" but sees nothing , does promiscuious have to be enabled ?

I already have that enabled via NtopNG (i think).

I can live with just one interface on bwd, if i can get it to log/account data.

[bingo600]

@johnpoz
I'll have a look at darkstat too.

And you are correct it is "Top talkers" i'd like to see.
And something like Cisco: ip accounting

[johnpoz]

Another one to track down top talkers is the iftop package, command line..

[bingo600]

I get no statistics on bwd.

How long time before stats are generated ?
Do i need promiscious ?

/Bingo

[johnpoz]

No you don't need promiscuous, but it will take a few minutes.. If your wanting to look now!! Your better off with darkstat or iftop..

[bingo600]

Dooh ....

I needed to remove the frame

[johnpoz]

I think it only updates like every 5 minutes or so though anyway.

You should see a timestamp in the top left on when it was last updated.

If you want pretty much realtime reporting then darkstat or iftop would be better tools. The other thing better with iftop is will show you the IP pair, ie where your client is sending or pulling data from.. Unlike bandwidthd that just reports on single IP.

Darkstat will give you the ports that were used, etc. But doesn't easy list the actual IP pairs that were doing the talking..

[bingo600]

Just tried darkstat , nice program.
But it seems to log all ip addy's , incl Inet.

Do you guys limit it in #of hosts , or just enable it when needed ?

/Bingo

[johnpoz]

I only turn it on if looking for something.

[bingo600]

@johnpoz said in Is it possible to show traffic (byte) accouning per local source ip:

I only turn it on if looking for something.

Makes sense.

DS has already revealed one of my ISP's cache servers (Local TV streaming channel) , i can see ~equal ATV4 in/out bytes to that ip

Thanx for that tip

[bingo600]

iftop seems nice too
Realtime top talkers src/dst

Thank you for guiding me here Steve/JP

I'll let bwd run , and keep the other two in the "toolbox"

/Bingo

[bingo600]

Hmm .... Seems like bwd's byte count is reset ?

My ATV4 was on 500MB , now it's on 76MB

Would iftop or DS interfere with bwd , causing a bytecount reset ?

[johnpoz]

I wouldn't think so.. What timezone are you in - is it just past midnight there, maybe you cycled days on bwd.

[bingo600]

CET (well CEST right now) - Europe

GUI says : Wed Aug 26 20:17:53 CEST 2020

[bingo600]

@johnpoz said in Is it possible to show traffic (byte) accouning per local source ip:

I wouldn't think so.. What timezone are you in - is it just past midnight there,

Hmmm i would have expected a US TZ from you

CN or ??

[johnpoz]

I'm US timezone - CST..