UNIX for Advanced & Expert Users

Hi Gurus,

Need to have a way to monitor Bandwidth utilization on Linux servers, running squid .

Have worked on 3rd party monitoring tools like Bandwidth d, Nagios etc.
But we are working to find out a way to monitor this through Sitescope, for which we need to find a file [if any] where the Bandwidth utlization can be logged.

As per my expertise we can do this through iptables. But not very sure how to have a log of the Bandwidth utilization which is required to get this monitored through Sitescope.

Pls. forward me to any of the available threads, Since I could not find anything relevant in my search.

An early response is very much apreciated...

Thanx..

The best way is to use pcap library and write small programm (look at http://www.tcpdump.org/pcap.htm) that monitors all packets which have HTTP header with url of the target site (you can skip parsing all protocols, just look into packet's header for url of the site). But this will not work for SSL

Also try tc (traffic control from iproute2 package). I dont know whether this is appropriate for you but with tc you can create different filters (e.g. according to IP adresses, TCP ports, etc.) and get statistics for that filters, i.e. something similar to

$ tc -s qdisc
qdisc htb 1: dev eth0 r2q 10 default 1 direct_packets_stat 0
Sent 21655 bytes 62 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0

A realize that all approaches above are very 'low-level', then just search on sf.net

iptraf, bwmon, ifstat can be useful if your system is only running Squid. Else to find out protocol/application specific b/w usage there is MUST to write your own small program/script using pcap,tc,iptables

Thanks for the info. Guys, On Googling came to know that we can implement through iptables. But was not pretty sure as how to achieve this.
But I wud like to use iptables facility to implement this, Since we want to do this using only the existing features [and no 3rd party ] on RHEL AS 3 and 4.

Can some one guide me how wud I do this.

Thank you...

I think all you need is http://www.netfilter.org/projects/iptables/index.html