'transparent' ip traffic monitoring

Posted by: andym

'transparent' ip traffic monitoring - 13/06/2008 17:47

I'm looking to prove that a wan link into my building at work is saturated. Is there an application i can run that would connect two ethernet interfaces together so it could be put 'in circuit' so traffic passes transparently through it and then the amount of data is logged over time.

I realise i could probably get this out of the router itself but i don't have the relevant privs to log in. It's owned by the link provider.
Posted by: mlord

Re: 'transparent' ip traffic monitoring - 13/06/2008 18:01

Yes, just insert a dual-NIC Linux box (any flavour, really), and have it route packets between the two interfaces.

ethtool -S ethX will then tell you more than you ever wanted to know about the traffic.

-ml
Posted by: mlord

Re: 'transparent' ip traffic monitoring - 13/06/2008 18:03

Originally Posted By: mlord
Yes, just insert a dual-NIC Linux box (any flavour, really), and have it route packets between the two interfaces.

One way to accomplish that very simply, is to just tell the system to bridge the two interfaces, making the Linux box itself 100% transparent.

The man page for brctl is a good place to look for the exact syntax.

EDIT:
The box itself could simply be a notebook, with an extra USB NIC attached, running a LiveCD distro (no install required).

-ml
Posted by: wfaulk

Re: 'transparent' ip traffic monitoring - 13/06/2008 18:32

Mark's answer is correct. I'd go with the bridge option, as it won't require you to make any changes on your network otherwise.

However, if you have a managed switch (that is, one you can log into, basically) that's attached to the router, you should be able to get that information directly from it.
Posted by: andym

Re: 'transparent' ip traffic monitoring - 13/06/2008 18:33

I've actually got the perfect box for this... Low power and three NICs. Will get to work on it on Monday!