Subject: Counting both ways?

From: Ralph Angenendt <[email-masked]>
Date: Wed, 27 Oct 1999 18:19:12 +0200

Hi,

we're trying to measure traffic on a router (1 WAN card, two
Ethernet cards). We're measuring on one Ethernet card.

What we're trying to measure is 

a) the traffic which goes to and from the proxy on that machine
   (Port 3128),

b) all other traffic going from our Network into the outer world

c) so we ignore all Traffic, which is coming from our Network and
   goes back into our Network - except port 3128.

But:

We have difficulties measuring the traffic which comes from port
3128 and goes back into our network - I can see the traffic going
from our Network to the proxy.

If I turn off all other measuring, I can see those packets - but
even if I try to measure the stuff which is arriving at the proxy, I
can't see the traffic which comes back from the proxy.

I can't find any logical errors in this srl-file, but maybe I am
just misunderstanding the whole concept of Netramet ;-)

Any help would be greatly appreciated,

Ralph

So here's the relevant part of our srl-file (the call to
kostenstelle just gives each packet a FlowKind, and calls the
log()-Subroutine - which is included here:

SET 10;

FORMAT SourcePeerAddress DestPeerAddress SourceTransType
DestTransType SourceTransAddress DestTransAddress FlowKind ToOctets
FromOctets;

define proxy = 3128;
define ignore_nets = ( 192.168.0.0/16, 62.96.219.0/24);

if SourcePeerType == IPv4
{
  if SourceTransAddress == proxy
    { call kostenstelle ()
      endcall;
    }
 else if DestTransAddress == proxy
     { call kostenstelle ()
      endcall;
    }
  
  else if (SourcePeerAddress == ignore_nets && DestPeerAddress == ignore_nets)
  { ignore; }

  else 
  { call kostenstelle ()
    endcall; }
}
else ignore;
count;

subroutine kostenstelle ()

#Kostenstelle Letras

if (DestPeerAddress == 62.96.219.225 || SourcePeerAddress == 62.96.219.225) 
  { store FlowKind := 'L';
    call log ()
    endcall; }

[... Huge snip ...]    
    
else { store FlowKind := '?';
       call log ()
       endcall; }
endsub;

subroutine log ()
    save SourcePeerAddress;
    save DestPeerAddress;
    save SourcePeerType;
    save DestPeerType;
    save SourceTransType;
    save DestTransType;
    save SourceTransAddress;
    save DestTransAddress;
endsub;

-- 
__________________________________________________________________________
Ralph Angenendt       | "Military justice is to justice what military
http://www.letras.de  |  music is to music"
[email-masked]          |                -- Groucho Marx