Начинал по статье http://www.lissyara.su/?id=1750
Наворотов не требовалось. Только все скидывать в MySQL.
Потом SQL запросами можно выбирать по дням, портам, направлению.
Как вспомню, приложу )
Можно из этого мини-статейку сделать.
Имеется шлюз - интерфейсы em0 - внутрь и em1 - наружу, FreeBSD 7.1
Читаем вышеуказанную статью.
Собираем ядро с доп. опциями:
Код: Выделить всё
options NETGRAPH
options NETGRAPH_ETHER
options NETGRAPH_SOCKET
options NETGRAPH_TEE
Код: Выделить всё
cd /usr/ports/net-mgmt/ng_ipacct
make install clean
Код: Выделить всё
# $FreeBSD: ports/net-mgmt/ng_ipacct/files/ng_ipacct.conf,v 1.6 2008/06/03 10:40:16 skv Exp $
#
# Please read and meditate on netgraph(4), ipacctctl(8) and ngctl(8).
# Enable ng_ipacct (i.e. enable run startup script "ng_ipacct.sh")
#ng_ipacct_enable="YES"
# Enable kernel modules loading.
# On "ng_ipacct.sh start" all kernel modules specified
# in ${ng_ipacct_modules_list} will be loaded.
# Note: on "ng_ipacct.sh stop" only "ng_ipacct" will be unloaded.
ng_ipacct_modules_load="YES"
# Netgraph can load required ng_* modules automatically on the hook creation
# - except for "ng_ether". Generally, modules preloading is recommended.
# Do not add to this list modules which are statically compiled into kernel.
#ng_ipacct_modules_list="netgraph ng_ether ng_cisco ng_socket ng_tee ng_ipacct"
ng_ipacct_modules_list="ng_ipacct"
# List of monitored interfaces. For each interface additional vars must be
# specified in corresponding variables 'ng_ipacct_IFACE_*'.
# See examples below.
#ng_ipacct_interfaces="xl0 cx0 vpn0"
ng_ipacct_interfaces="em0 em1"
# Default start/stop scripts.
#
# Single quotes are required to preserve newlines.
# '%%iface%%' will be automatically expanded with a relevant interface.
# This feature should be applied to use indentical rules
# for similar interfaces.
ng_ipacct_default_ether_start='
mkpeer %%iface%%: tee lower right
name %%iface%%:lower %%iface%%_tee
connect %%iface%%: lower upper left
mkpeer %%iface%%_tee: ipacct right2left %%iface%%_in
name %%iface%%_tee:right2left %%iface%%_ip_acct
connect %%iface%%_tee: %%iface%%_ip_acct: left2right %%iface%%_out
'
ng_ipacct_default_ether_stop='
shutdown %%iface%%_ip_acct:
shutdown %%iface%%_tee:
shutdown %%iface%%:
'
ng_ipacct_bpf_ether_start='
mkpeer %%iface%%: tee lower right
name %%iface%%:lower %%iface%%_tee
connect %%iface%%: lower upper left
mkpeer %%iface%%_tee: bpf right2left %%iface%%_in
name %%iface%%_tee:right2left %%iface%%_bpf
connect %%iface%%_tee: right2left left2right %%iface%%_out
mkpeer %%iface%%_bpf: ipacct %%iface%%_match_in %%iface%%_in
name %%iface%%_bpf:%%iface%%_match_in %%iface%%_ip_acct
connect %%iface%%_bpf: %%iface%%_ip_acct: %%iface%%_match_out %%iface%%_out
'
ng_ipacct_bpf_ether_stop='
shutdown %%iface%%_ip_acct:
shutdown %%iface%%_bpf:
shutdown %%iface%%_tee:
shutdown %%iface%%:
'
# em0 - internal interface (x10 in demo)
ng_ipacct_em0_dlt="EN10MB" # required line; see ipacctctl(8)
ng_ipacct_em0_threshold="15000" # '5000' by default
ng_ipacct_em0_verbose="yes" # 'yes' by default
#ng_ipacct_em0_saveuid="yes" # 'no' by default
ng_ipacct_em0_savetime="yes" # 'no' by default
ng_ipacct_em0_start=${ng_ipacct_default_ether_start}
ng_ipacct_em0_stop=${ng_ipacct_default_ether_stop}
ng_ipacct_em0_checkpoint_script="/root/scripts/ng_ipacct.sh em0"
# em1 - internal interface (x10 in demo)
ng_ipacct_em1_dlt="EN10MB" # required line; see ipacctctl(8)
ng_ipacct_em1_threshold="15000" # '5000' by default
ng_ipacct_em1_verbose="yes" # 'yes' by default
#ng_ipacct_em1_saveuid="yes" # 'no' by default
ng_ipacct_em1_savetime="yes" # 'no' by default
ng_ipacct_em1_start=${ng_ipacct_default_ether_start}
ng_ipacct_em1_stop=${ng_ipacct_default_ether_stop}
ng_ipacct_em1_checkpoint_script="/root/scripts/ng_ipacct.sh em1"
Код: Выделить всё
ng_ipacct_em0_checkpoint_script="/root/scripts/ng_ipacct.sh em0"
ng_ipacct_em1_checkpoint_script="/root/scripts/ng_ipacct.sh em1"Код: Выделить всё
#!/bin/sh
IPACCTCTL="/usr/local/sbin/ipacctctl"
IFACE=$1
$IPACCTCTL ${IFACE}_ip_acct:$IFACE checkpoint
$IPACCTCTL ${IFACE}_ip_acct:$IFACE show | awk '{print "INSERT INTO `dbs_traffic`.`traffic_'$IFACE'` (`src_ip`,`src_port`,`dst_ip`,`dst_port`,`protocol`,`packets`,`bytes`,`unixtime`) VALUES (\""$1"\",\""$2"\",\""$3"\",\""$4"\",\""$5"\",\""$6"\",\""$7"\",\""$8"\"); "}' | /usr/local/bin/mysql -u <ИМЯ ПОЛЬЗОВАТЕЛЯ> -p<ПАРОЛЬ> <dbs_traffic>
$IPACCTCTL ${IFACE}_ip_acct:$IFACE clear
Код: Выделить всё
ng_ipacct_enable="YES"Код: Выделить всё
-- phpMyAdmin SQL Dump
SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
--
-- База данных: `dbs_traffic`
--
-- --------------------------------------------------------
--
-- Структура таблицы `traffic_em0`
--
CREATE TABLE IF NOT EXISTS `traffic_em0` (
`src_ip` varchar(15) NOT NULL,
`src_port` int(11) NOT NULL,
`dst_ip` varchar(15) NOT NULL,
`dst_port` int(11) NOT NULL,
`protocol` int(11) NOT NULL,
`packets` int(11) NOT NULL,
`bytes` int(11) NOT NULL,
`unixtime` int(11) NOT NULL
) ENGINE=MyISAM DEFAULT CHARSET=cp1251;
-- --------------------------------------------------------
--
-- Структура таблицы `traffic_em1`
--
CREATE TABLE IF NOT EXISTS `traffic_em1` (
`src_ip` varchar(15) NOT NULL,
`src_port` int(11) NOT NULL,
`dst_ip` varchar(15) NOT NULL,
`dst_port` int(11) NOT NULL,
`protocol` int(11) NOT NULL,
`packets` int(11) NOT NULL,
`bytes` int(11) NOT NULL,
`unixtime` int(11) NOT NULL
) ENGINE=MyISAM DEFAULT CHARSET=cp1251;Код: Выделить всё
*/5 * * * * /usr/local/etc/rc.d/ng_ipacct checkpointВесь входящий трафик по портам за февраль
Код: Выделить всё
SELECT FROM_UNIXTIME(unixtime,'%M') as Mounth, (SUM(bytes)/(1024*1024)) as Megabytes, dst_ip as IP, src_port as Port
FROM traffic_em1
WHERE
dst_ip='<Внешний IP Шлюза>'
AND unixtime > 1233435600
AND unixtime < 1235854800
GROUP BY src_port
Order By Megabytes DESC
Код: Выделить всё
SELECT FROM_UNIXTIME(unixtime,'%M') as Mounth, (SUM(bytes)/(1024*1024)) as Megabytes, dst_ip as IP
FROM traffic_em1
WHERE
dst_ip='<Внешний IP Шлюза>'
GROUP BY Mounth
Order By MounthКод: Выделить всё
SELECT
FROM_UNIXTIME(unixtime,'%M') as Mounth,
(SUM(bytes)/(1024*1024)) as Megabytes,
dst_ip as IP, src_port as Port
FROM traffic_em0
WHERE
src_port = 80
AND unixtime > 1233435600
AND unixtime < 1235854800
AND dst_ip LIKE '192.168.0.%'
Group By dst_ip
ORDER BY Megabytes DescКод: Выделить всё
SELECT
FROM_UNIXTIME(unixtime,'%M') as Mounth,
(SUM(bytes)/(1024*1024)) as Megabytes,
dst_ip as IP FROM traffic_em0
WHERE
unixtime > 1233435600
AND unixtime < 1235854800
AND dst_ip LIKE '192.168.0.%'
AND src_ip <> '<Внутренний IP шлюза>'
AND dst_ip <> '<Внутренний IP шлюза>'
Group By dst_ip
ORDER BY Megabytes Desc
