hmmm ... i don't really know if i should classify this as real time, but i'll go ahead. depends how much of your real time are u going to spend on it. background: following multiple papers@web first i started parsing whetever tool's output came in my hand e.g. ifconfig and so on, than i upgraded to ipchains/later on iptables accounting. (e.g create 2 chains, jump dst / src from ips to be monitored, querry the chain). still no satisfaction. than iptraf and friends. [and i even parsed human readable output to rrdtool's rrds.] still no satisfaction. this is not realtime. (or realtime = very complex for me?) following cisco's NetFlow implementations @ linux i came across multiple tools that would do similar things to ip flow export in cisco routers. none until couple of months guaranteed my satisfaction. i mean softflowd (disliked promiscuous mode), fprobe/ulogd-probe (too harsh combination of ulogd targets and network traffic sampling) and so on. even ntop. so i would recommend strongly using <<ipcad>> daemon to implement network traffic sampling and NetFlow export; flow-tools to capture NetFlow dataflow and analyze. and this is real time by all means traffic monitoring.not just 100kbps on this target, but 10 packets there, 200 bits there, when, where, all beeing agregated and transformed to feed one's joy to handle numbers. lots. have phun. NightInTheCity _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
