internet (without LAN) monthly traffic statistics

[Bill Davidsen]

Tony Nelson wrote:
> On 09-11-18 09:32:54, Ryan Lynch wrote:
>> On Wed, Nov 18, 2009 at 09:27, Dj YB <yehielb at mail.ru> wrote:
>>> iptraf is really complicated and require too many changes,
>>> vnstat doesn't support the separation using single interface...
>>> any help on this matter will be greatly appreciated.
>> Cacti is good at this, and I think MRTG can do it, too. But neither 
>> of those is simple to set up. I'd give them a try, though, you might 
>> do OK.
>>
>> Depending on exactly what numbers you need, NTop is also a
>> possibility. It's dead easy to set up, and it's capable of breaking
>> out separate interfaces. The level of detail will be enormous, but
>> it's actually (IMHO) much easier/faster to get running than either
>> Cacti or MRTG.
>>
>> If you're good with any scripting languages, you might want to
>> consider just polling the kernel's interface counters, yourself, via 
>> a regular 'cron' job. That might not be an option, though, depending 
>> on your skill level.
> 
> If the problem is sorting out which traffic went through the pay 
> connection, perhaps IPTables could be used.  Just an idea...
> 
If the NIC sees all the packets you can get a rough approximation:
  iptables -I INPUT ! -s 10.0.1.0/24  #<- your LAN net address here
  iptables -I OUTPUT ! -s 10.0.1.0/24 #<- and here

run that at the start of the month, then
  iptables -L INPUT -nv | head
  iptables -L OUTPUT -nv | head

would give you the packets and bytes sent to (received from) non-local IP 
addresses. Ugly, inconvenient, must be started at the beginning of the month, 
data lost on reboot, all of which you could hack around with clever scripts, but 
there must be a better way.

The better way is probably MRTG or similar, which are complex to install, then 
work well and do what you want. I'd skip iptables, it's pretty ugly and high 
overhead to do right.

-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot