I need to know the ratio of certain services (ports) used by my network, eg. port 80,8080,443, 8443,25,110,1723,5060, the_rest
Is there a way to get info like this? I already parse the ip/accounting details for IP-pairs & usage stats but need to add port details to that to determine the ratio between ftp, pop, smtp, sip, http & https traffic to all other traffic. I don’t need per-ip, just total traffic per-port through router.
Ekkas
You can use the Torch to see traffic types.
The Dude does nice job with the Torch:
Ok, thanks I’ll check it out but what would be nice is to get it off router so I can log it in my own software to draw stats/totals over time. I can use API or Telnet from my software to get the info.
This will already help a lot, thank you.
Ekkas
Edit: This will work just fine, I just set the seconds to 60 or so and already see the trends I was expecting.
for more details, you can try NetFlow (IP → TrafficFlow) + Ntop or something
You could use the “random” matcher with a log action if you want a longer term approach with less traffic. You can simply parse the generated logs to create reports. The “best” solution is to use Chapuka’s suggestion of Netflow data.