While I'm going to be switching to a slightly saner plan soon, being stuck on a 5GB monthly bandwidth cap has made me very data-conscious, and I'm looking for a way to log my Internet usage in such a way that I can see how much I've uploaded, and how much I've downloaded, to each port on each host/IP I visit; seeing "you downloaded 823.64MB and uploaded 92.12MB last Tuesday" on my ISP's web portal isn't especially insightful...

I have a couple of extra considerations I'd like to take into account:

  • I would like the monitoring system to be as lightweight as possible. While existing software would be preferred, at the most extreme I'd consider a simple homemade C libpcap program, if there are examples that I could get up and running from with less than 150 lines of trivial modifications.

  • Since just about everything that works with a domain name is going to do a DNS lookup to find the IP address, a system which sniffs for the DNS lookup response and uses that to associate IP addresses with hostnames - rather than making an indepentant/spurious call - would be nice to have.

  • wireshark have a great community around. There must be a solution.

    For example: Raw dumping full of traffic via tcpdump, as you are mention, there is not so much - 5GB. With 8GB or 16GB of RAM you could read this file on the PC in probably maximally optimal format today with wireshark.

    In this case CPU load a bit.

  • Have you look at the ntop?

    Since they are going deep, there is no mysql support anymore. Somehow, part of IP addresses truncated from time to time. I can't guarantee that this tool will logs everything.

    Sometimes, it takes a huge part of CPU.

  • Look at splunk - it is commercial product with demo period.

    There are so many beautiful plugins! Not leave indifferent anybody.

All this three tools can give you logging by ip:port.

  • I frequently use Wireshark myself - used it earlier today to check a browser's POST output :) - but only to capture specific information. I'll see what the community says - I asked ask.wireshark.org/questions/30791/…. What do you mean by "not so much - 5GB"? This PC has 640MB of RAM in it, and it also does many other tasks, so I really meant lightweight :P Thanks for the mention about ntop; won't go there ;) - and I've heard of Splunk, but I get the impression I'd need a datacenter to take advantage of it :P
    – i336_
    Mar 14 '14 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.