Hi Michael, depending on your expected throughput, net-acct might do what you want. We've put a tap on our uplink and used that for accounting. Worked pretty well for 1Gbit/s streams. The package has some problems with lots of small packets, though. For higher bandwidths it makes sense to move to something like S/FLOW and live with the approximation. Best regards, i.A. Thomas Bätzler -- BRINGE Informationstechnik GmbH Zur Seeplatte 12 D-76228 Karlsruhe Germany Fon: +49 721 94246-0 Fon: +49 171 5438457 Fax: +49 721 94246-66 Web: http://www.bringe.de/ Geschäftsführer: Dipl.-Ing. (FH) Martin Bringe Ust.Id: DE812936645, HRB 108943 Mannheim -----Ursprüngliche Nachricht----- Von: Michael Dickensheets <michael.dickensheets@xxxxxxxxx> Gesendet: Freitag, 3. Dezember 2021 14:17 An: netfilter@xxxxxxxxxxxxxxx Betreff: Recovery of packet size Hello, We are trying to build fine-grained traffic accounting. Counters do not provide sufficient details; we need timestamps for individual packets, etc. We are trying to use logging target with the 'snaplen' option to minimize overhead. What we are missing though is the size of the original packet (skb->len). Is there a way to retrieve this value? If this is not currently possible, how would we best go about adding this functionality? Best regards, Michael Dickensheets
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
