tools to monitor network traffic from the server side

I've played with Cricket, Cacti, MRTG etc. before to monitor network
traffic but I've always done this by querying the switches concerned. Is
there a way to do something similar on the server side?

The reason for this is that this time around I don't have "root" access
over the switches. So rather than go through all the political channels to
get the SNMP access to the switches it'd be quicker to monitor from the
servers themselves where I do have complete control.

Any tools that can do this? Or at a more of a "hack" level can I get an
indirect idea of network activity by monitoring some kernel network
variable? After all the eth card must know how many packets it sent /
recieced, right?

--
Rahul

On 07/28/10 04:29, Arimus wrote:
> On Jul 28, 12:27 am, Rahul<nos...@nospam.invalid> wrote:
> [snip]
>>
>> Any tools that can do this? Or at a more of a "hack" level can I get an
>> indirect idea of network activity by monitoring some kernel network
>> variable? After all the eth card must know how many packets it sent /
>> recieced, right?
>>
>> --
>> Rahul
>
> What info do you want? If you have root access to the servers stick
> net-snmp on the servers and you'll get the majority of the information
> you can get from a switch/router etc...
>
> Otherwise look at something like ntop (http://www.ntop.org)

iptables also has some accounting abilities.

Arimus <(E-Mail Removed)> wrote in news:048e21eb-7f59-4065-832c-
(E-Mail Removed):

> What info do you want? If you have root access to the servers stick
> net-snmp on the servers and you'll get the majority of the information
> you can get from a switch/router etc...

Thanks! I do have root access to the server. I want some pretty basic info:
e.g. bandwidth used.





--
Rahul

Joe Beanfish <(E-Mail Removed)> wrote in news:i2pq48
$(E-Mail Removed):

> iptables also has some accounting abilities.
>

Thanks! I do use iptables for a firewal + NAT but didn't realize it could
be used for accounting as well. Will check it out.

--
Rahul

On 2010-07-30, Arimus <(E-Mail Removed)> wrote:
> On Jul 30, 1:57*am, Rahul <nos...@nospam.invalid> wrote:
>
>> Thanks! I do have root access to the server. I want some pretty basic info:
>> e.g. bandwidth used.
>
>
> In that case net-snmp, ntop or using iptables to do accounting (not
> used ipt personally for accounting so no idea on its feature set in
> that regard) will give you what you need.
>
> net-snmp means you can use your existing mrtg experience,
> ntop gives you some pretty nice stats and remote 9web) access if you
> enable it,
> ipt - not a clue when you use it for accounting - firewalling, nat and
> packet mangling/marking is more my area of knowlege for ipt.

Here's a link to a script you can run with cron to
monitor the bandwidth tx/rx of a server:
http://fixunix.com/slackware/332610-...h-monitor.html
should work with any distribution.
--
Charles Polisher

On 07/31/2010 04:24 PM, Charles Polisher wrote:
[SNIP] knowlege for ipt.
>
> Here's a link to a script you can run with cron to
> monitor the bandwidth tx/rx of a server:
> http://fixunix.com/slackware/332610-...h-monitor.html
> should work with any distribution.

# /usr/local/bin/logifx eth0
PANIC: reading ifconfig

# ifconfig eth0
eth0 Link encap:Ethernet HWaddr nn:nn:nn:nn:nn:nn
inet addr:10.12.24.30 Bcast:10.12.24.255 Mask:255.255.255.0
inet6 addr: fe80::221:70ff:febd:a34f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2540835 errors:0 dropped:0 overruns:0 frame:0
TX packets:2399469 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:920724581 (920.7 MB) TX bytes:278641991 (278.6 MB)
Interrupt:17

Dist is Ubuntu 10.04 x64

Opps!

--
Please do not reply to my Email address. It is a faux Email address.
Cyberpunk FPS/MMORG www.neocron.com
Runs on Windows, platinum in latest WINE/Ubuntu. Running since 2002.

ntop

I thought that I would try and install this, but alas the package from
ntop.org (via sourceforge) is incomplete, or poorly documented.

The tarball contains the ascii file : INSTALL, which has this at the top
of it:
"Basic Installation
==================

Briefly, the shell commands `./configure; make; make install' should
configure, build, and install this package. The following
more-detailed instructions are generic; see the `README' file for
instructions specific to this package."

Of course, the file configure is not in the tarball ntop-4.0.tar.gz:-
# pwd
/tmp/ntop-4.0.1
# find | grep configure
../misc/configure.in.perl
../misc/configure.in.lua
../configure.in
../configureextra
../configureextra/FREEBSD
../configureextra/AIX
../configureextra/LINUXredhat9
../configureextra/functions
../configureextra/readme
../configureextra/LINUXsuse
../configureextra/SOLARIS8
../configureextra/LINUXwhitebox3.0
../configureextra/openbsd
../configureextra/HPUX
../configureextra/LINUXredhat3
../configureextra/LINUXredhat8.0
../configureextra/SOLARIS9
../configureextra/python-config
../configureextra/DARWIN
../configureextra/LINUXmandrake
../configureextra/SOLARIS10
../packages/FreeBSD-ports/net/ntop/files/patch-configure
../packages/FreeBSD-ports/net/ntop/files/patch-configure-in

nice one



--
Please do not reply to my Email address. It is a faux Email address.
Cyberpunk FPS/MMORG www.neocron.com
Runs on Windows, platinum in latest WINE/Ubuntu. Running since 2002.