Mailing List Archive

On Thu, 2005-06-09 at 11:04 +0200, Kurt Jaeger wrote:
> Hello,
>
> I've a question about traffic metering with IPv6.
>
> Our core router is a FreeBSD system (we're a small ISP, so it's
> sufficient for us...).
>
> I'm looking for tools to count IPv6 packets/bytes based on flows
> that would run on such a system. We want to use it to do traffic
> metering and billing.

Check http://www.ipng.nl/software/yaps/ and don't forget to ask Pim for
Yana too

> We wrote our own for IPv4, based on tcpdump, and the question is
> now: Will we do those mods for v6 again or can we use something
> that has wider use ?

That of course depends completely on what you want and how custom you want it.
(I do hope you used libpcap instead of shelling around tcpdump ;)

Also see:
http://www.switch.ch/tf-tant/floma/software.html

And never forget: http://www.ntop.org ;)

Greets,
Jeroen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: This is a digitally signed message part
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20050609/af7c3f4a/attachment.bin

On Thu, Jun 09, 2005 at 11:04:11AM +0200, Kurt Jaeger wrote:
> Hello,
>
> I've a question about traffic metering with IPv6.
>
> Our core router is a FreeBSD system (we're a small ISP, so it's
> sufficient for us...).
>
> I'm looking for tools to count IPv6 packets/bytes based on flows
> that would run on such a system. We want to use it to do traffic
> metering and billing.
>

I'd advise using Netflow, but this would require :
- updating to FreeBSD-5.4
- hacking IPv6 support into ng_netflow(4) (netgraph node in base FBSD install)
- hacking IPv6 support into net-mgmt/flow-tools (from FBSD ports)


v.

On Thu, 9 Jun 2005, Vladimir Kotal wrote:

> On Thu, Jun 09, 2005 at 11:04:11AM +0200, Kurt Jaeger wrote:
>> Hello,
>>
>> I've a question about traffic metering with IPv6.
>>
>> Our core router is a FreeBSD system (we're a small ISP, so it's
>> sufficient for us...).
>>
>> I'm looking for tools to count IPv6 packets/bytes based on flows
>> that would run on such a system. We want to use it to do traffic
>> metering and billing.
>>
>
> I'd advise using Netflow, but this would require :
> - updating to FreeBSD-5.4
> - hacking IPv6 support into ng_netflow(4) (netgraph node in base FBSD install)
> - hacking IPv6 support into net-mgmt/flow-tools (from FBSD ports)
>

There are some alternatives to netflow which supports IPv6 (Netflow v9).
You can try:
flowd and softflowd - see port net-mgmt/flowd and net-mgmt/softflowd
or
you can try
pmacct and pmacct-fe - see port net-mgmt/pmacct

Regards,

Janos Mohacsi
Network Engineer, Research Associate
NIIF/HUNGARNET, HUNGARY
Key 00F9AF98: 8645 1312 D249 471B DBAE 21A2 9F52 0D1F 00F9 AF98

>
> v.
>

Hi all:
you can try Ethereal.
It's a GNU licence, it supports a huge number of protocols, it installs in a number of platforms, and its been working fine for us (we've been using it for some time now).

Check www.ethereal.com

Best regards,

Nuno Garcia,
PhD Student
Siemens Communications Portugal
COM RD1 R
nuno.mgarcia@siemens.com

-----Mensaje original-----
De: ipv6-ops-bounces+nuno.mgarcia=siemens.com@lists.cluenet.de en nombre de Mohacsi Janos
Enviado el: jue 09/06/2005 11:08
Para: Vladimir Kotal
CC: Kurt Jaeger; ipv6-ops@lists.cluenet.de
Asunto: Re: IPv6 traffic metering







On Thu, 9 Jun 2005, Vladimir Kotal wrote:

> On Thu, Jun 09, 2005 at 11:04:11AM +0200, Kurt Jaeger wrote:
>> Hello,
>>
>> I've a question about traffic metering with IPv6.
>>
>> Our core router is a FreeBSD system (we're a small ISP, so it's
>> sufficient for us...).
>>
>> I'm looking for tools to count IPv6 packets/bytes based on flows
>> that would run on such a system. We want to use it to do traffic
>> metering and billing.
>>
>
> I'd advise using Netflow, but this would require :
> - updating to FreeBSD-5.4
> - hacking IPv6 support into ng_netflow(4) (netgraph node in base FBSD install)
> - hacking IPv6 support into net-mgmt/flow-tools (from FBSD ports)
>

There are some alternatives to netflow which supports IPv6 (Netflow v9).
You can try:
flowd and softflowd - see port net-mgmt/flowd and net-mgmt/softflowd
or
you can try
pmacct and pmacct-fe - see port net-mgmt/pmacct

Regards,

Janos Mohacsi
Network Engineer, Research Associate
NIIF/HUNGARNET, HUNGARY
Key 00F9AF98: 8645 1312 D249 471B DBAE 21A2 9F52 0D1F 00F9 AF98

>
> v.
>

NTOP (www.ntop.org) supports IPv6 and will record and display a massive
amount of statistics using a built in web interface.

You could also try aflow (www.aflow.org). It relies on netflows and
would probably require some hacking to get it to work for you I'm sure
Dan (the author) would appreciate any patches you come up with.

-Matt

On 9-jun-2005, at 14:17, Matt Ryanczak wrote:

> NTOP (www.ntop.org) supports IPv6

> You could also try aflow (www.aflow.org). It relies on netflows and
> would probably require some hacking to get it to work for you

A simpler way is to use the firewall statistics in (for instance)
ip6fw: just make specific "allow" rules for everything you want to
measure and then issue "ip6fw show".

Hi!

> A simpler way is to use the firewall statistics in (for instance)
> ip6fw: just make specific "allow" rules for everything you want to
> measure and then issue "ip6fw show".

Two questions arise:

- Does it scale if one has to count approx. 2-3K objects ?
- This only counts.

For v4, we have some sort of hourly traffic matrices (which is
useful in case of backtracking problems). We'd like to use
flow data to be able to have this kind of backtracking
also for v6.

--
MfG/Best regards, Kurt Jaeger 15 years to go !
LF.net GmbH fon +49 711 90074-23 pi@LF.net
Ruppmannstr. 27 fax +49 711 90074-33
D-70565 Stuttgart mob +49 171 3101372

On 9-jun-2005, at 16:06, Kurt Jaeger wrote:

>> A simpler way is to use the firewall statistics in (for instance)
>> ip6fw: just make specific "allow" rules for everything you want to
>> measure and then issue "ip6fw show".

> Two questions arise:

> - Does it scale if one has to count approx. 2-3K objects ?

Not sure. The trouble with ip6fw is that apparently, it evaluates
every rule until there is a match, which isn't cool when you match
the last rule. But many years ago we did something like this for IPv4
(not nearly 2 to 3 k, though) and it worked better than I expected.

> - This only counts.

> For v4, we have some sort of hourly traffic matrices (which is
> useful in case of backtracking problems). We'd like to use
> flow data to be able to have this kind of backtracking
> also for v6.

Not sure what you mean, but obviously you store the counters in a
file or database periodically.

Iljitsch

[using ip6fw to count]
> >- This only counts.
>
> >For v4, we have some sort of hourly traffic matrices (which is
> >useful in case of backtracking problems). We'd like to use
> >flow data to be able to have this kind of backtracking
> >also for v6.
>
> Not sure what you mean, but obviously you store the counters in a
> file or database periodically.

Yes. Something like

source dest bytes packets
212.9.190.63 213.209.108.155 2144 23
82.185.97.58 212.9.190.63 300 5
80.174.98.138 212.9.190.63 144 3
67.18.120.34 212.9.190.63 2372 6
[...]

That's not flow-based, but just an hourly dump of the traffic
the interface has seen during the last hour.

For v6, I'd like to have some flow-based approach.

I'll investigate the suggestions from the list. If I find something,
I'll summarise.

--
MfG/Best regards, Kurt Jaeger 15 years to go !
LF.net GmbH fon +49 711 90074-23 pi@LF.net
Ruppmannstr. 27 fax +49 711 90074-33
D-70565 Stuttgart mob +49 171 3101372

Hi,

did you hear about 6QM tool (www.6qm.org)?

It is an IPv6 specific tool desinged to capture/measure IPv6 traffic, which
includes advances features like interdomain measurements, bandwidth
measurements, etc.

Maybe it could be interesting for your purposes.

Regards
Miguel


----- Original Message -----
From: "Kurt Jaeger" <lists@complx.LF.net>
To: <ipv6-ops@lists.cluenet.de>
Sent: Thursday, June 09, 2005 11:04 AM
Subject: IPv6 traffic metering


> Hello,
>
> I've a question about traffic metering with IPv6.
>
> Our core router is a FreeBSD system (we're a small ISP, so it's
> sufficient for us...).
>
> I'm looking for tools to count IPv6 packets/bytes based on flows
> that would run on such a system. We want to use it to do traffic
> metering and billing.
>
> I know of the following tools:
>
> http://www.mindrot.org/pfflowd.html
> http://www.ba.cnr.it/~paolo/pmacct/
> http://www.nitpicker.de/temp/
> http://nfdump.sourceforge.net/
> http://sourceforge.net/projects/ipcad/
> http://robert.cheramy.net/ipfm/
>
> We wrote our own for IPv4, based on tcpdump, and the question is
> now: Will we do those mods for v6 again or can we use something
> that has wider use ?
>
> Any comments on those and pointers to others would be helpful.
>
> --
> MfG/Best regards, Kurt Jaeger 15 years to
> go !
> LF.net GmbH fon +49 711 90074-23 pi@LF.net
> Ruppmannstr. 27 fax +49 711 90074-33
> D-70565 Stuttgart mob +49 171 3101372
>




************************************
The IPv6 Portal: http://www.ipv6tf.org

Barcelona 2005 Global IPv6 Summit
Information available at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.