How to count number of hosts through a mirror port

Hi all,

I just setup a linux (RH 9) and install the Ethereal to capture the
network traffics. It connects to a switch mirror port that mirror the
traffics of Corporate users to access the Internet. I would like to
count the numbers of hosts that access the Internet. Is there any
tools (for Linux RH 9) that can do so? Please note that my Linux only
support TEXT mode only. Thanks.

Regards,
Dovelet

Dovelet wrote:
> I just setup a linux (RH 9) and install the Ethereal to capture the
> network traffics. It connects to a switch mirror port that mirror the
> traffics of Corporate users to access the Internet. I would like to
> count the numbers of hosts that access the Internet. Is there any
> tools (for Linux RH 9) that can do so? Please note that my Linux only
> support TEXT mode only.

You can use either tethereal or tcpdump to capture traffic, then either
custom code or tethereal/tcpdump + perl to do the analysis. You should
take a look at the CAIDA website for tools you could use/adapt for this
purpose.

You need to think hard about privacy issues before you start doing this.
You might want to consider using tcpdpriv (with appropriate arguments)
to do the traffic capture. You also need to give some thought to issues
like notifying your users and limiting access to the data.

On 8 17 , 8 16 , Allen McIntosh <nos...@mouse-potato.com> wrote:
> Doveletwrote:
> > I just setup a linux (RH 9) and install the Ethereal to capture the
> > network traffics. It connects to a switch mirror port that mirror the
> > traffics of Corporate users to access the Internet. I would like to
> > count the numbers of hosts that access the Internet. Is there any
> > tools (for Linux RH 9) that can do so? Please note that my Linux only
> > support TEXT mode only.
>
> You can use either tethereal or tcpdump to capture traffic, then either
> custom code or tethereal/tcpdump + perl to do the analysis. You should
> take a look at the CAIDA website for tools you could use/adapt for this
> purpose.
>
> You need to think hard about privacy issues before you start doing this.
> You might want to consider using tcpdpriv (with appropriate arguments)
> to do the traffic capture. You also need to give some thought to issues
> like notifying your users and limiting access to the data.

Hi,

Thank you of your information. I want to count the numbers of users
access the Internet per day but my harddisk is not large enough to
capture all traffics for a whole day. Do you have any other idea?
Thanks.

Thank you of your remind, I will consider the privacy issues.

Regards,
Dovelet

>>> I just setup a linux (RH 9) and install the Ethereal to capture the
>>> network traffics. It connects to a switch mirror port that mirror the
>>> traffics of Corporate users to access the Internet. I would like to
>>> count the numbers of hosts that access the Internet. Is there any
>>> tools (for Linux RH 9) that can do so? Please note that my Linux only
>>> support TEXT mode only.
>> You can use either tethereal or tcpdump to capture traffic, then either
>> custom code or tethereal/tcpdump + perl to do the analysis. You should
>> take a look at the CAIDA website for tools you could use/adapt for this
>> purpose.
> Thank you of your information. I want to count the numbers of users
> access the Internet per day but my harddisk is not large enough to
> capture all traffics for a whole day. Do you have any other idea?


1) See previous advice re. CAIDA

2) Run output of tcpdump/tethereal through a program that does the counting.

3) Modify tcpdump or similar program to do what you want.

Dovelet wrote:
> On 8 17 , 8 16 , Allen McIntosh <nos...@mouse-potato.com> wrote:
>> Doveletwrote:
>>> I just setup a linux (RH 9) and install the Ethereal to capture the
>>> network traffics. It connects to a switch mirror port that mirror the
>>> traffics of Corporate users to access the Internet. I would like to
>>> count the numbers of hosts that access the Internet. Is there any
>>> tools (for Linux RH 9) that can do so? Please note that my Linux only
>>> support TEXT mode only.
>> You can use either tethereal or tcpdump to capture traffic, then either
>> custom code or tethereal/tcpdump + perl to do the analysis. You should
>> take a look at the CAIDA website for tools you could use/adapt for this
>> purpose.
>>
>> You need to think hard about privacy issues before you start doing this.
>> You might want to consider using tcpdpriv (with appropriate arguments)
>> to do the traffic capture. You also need to give some thought to issues
>> like notifying your users and limiting access to the data.
>
> Hi,
>
> Thank you of your information. I want to count the numbers of users
> access the Internet per day but my harddisk is not large enough to
> capture all traffics for a whole day. Do you have any other idea?
> Thanks.
>
> Thank you of your remind, I will consider the privacy issues.

(I thought I posted a reply, but it seems to have disappeared.)

If you don't have enough disk space, then you will need to run output
from tcpdump/tethereal directly through your tool of choice to do the
counting. The alternative is something you build/modify yourself.
Check the tools taxonomy on the CAIDA website for tools that will do
some (or all, if your are lucky) of the work for you.