For getting details of network transactions, you have got a implementation of a Netflow generator for FreeBSD or Linux:
ng_netflow - Cisco's NetFlow implementation
The ng_netflow node implements Cisco's NetFlow export protocol on a
router running FreeBSD. The ng_netflow node listens for incoming traffic
and identifies unique flows in it. Flows are distinguished by endpoint
IP addresses, TCP/UDP port numbers, ToS and input interface. Expired
flows are exported out of the node in NetFlow version 5/9 UDP datagrams.
As for NetFlow itself:
NetFlow is a network protocol developed by Cisco for collecting IP
traffic information and monitoring network traffic. By analyzing flow
data, a picture of network traffic flow and volume can be built.
also rfc 3954 - NetFlow Services Export Version 9
For storing the Netflow data you also need what is know as a server collector. It can be either a Linux or a FreeBSD box. It should not be installed on the actual router. One such known implementation is nfsen
NfSen is a graphical web based front end for the nfdump netflow tools.
NfSen allows you to:
- Display your netflow data: Flows, Packets and Bytes using RRD (Round
- Easily navigate through the netflow data.
- Process the netflow data within the specified time span.
- Create history as well as continuous profiles.
- Set alerts, based on various conditions.
- Write your own plugins to process netflow data on a regular interval.
Be aware that, depending on your available bandwidth, generating NetFlows can be taxing on the CPU. A known strategy in some cases is doing a mirror of the switch port of the router, and using another machine for those operations.
After a certain threshold of bandwidth it probably makes more sense going for a professional router if generating NetFlows is a requirement.
As a final alert, having NAT, the NetFlows have to be captured in the inside/LAN interface, as otherwise you will lose the sense of whom is doing what.
I use up around 100GB of data for 5-6 months of traffic, using NfSen collecting NetFlow data from Cisco equipment, your mileage may vary.