From: Burton M. Strauss III (BStrauss_at_acm.org)
To: "Piotr Kowalczyk" <email@example.com>, <firstname.lastname@example.org> Date: Sun, 6 Jun 2004 07:36:17 -0500
You are going to find that to be difficult or impossible.
The standard library, libpcap (http://www.tcpdump.org), that most tools use,
does a physical capture and so does not differentiate between the logical
It's then up to the tool to figure out which interface a packet 'came in on'
and that's hard. It's easy to split 'em up by network address (based on the
virtual ip address), but what about the broadcasts???
Ultimately, most tools just choose to ignore it and report traffic on
If it's critical to you, the only ways I know to solve this are:
1) grab one of the multiport cards and use multiple physical interfaces.
2) Use VLANs - but that's setting yourself up for other pain.
US-based commercial support for ntop:
Search the ntop mailing lists at gmane:
(nearly current) ntop FAQ including "HowTo Ask for Help" at
> -----Original Message-----
> From: Piotr Kowalczyk [mailto:email@example.com]
> Sent: Friday, June 04, 2004 4:34 AM
> To: firstname.lastname@example.org
> Subject: mrtg/snmp/subinterfaces
> Tell me, is there any reasonable way to monitor subinterfaces
> utilization on linux router? It's not difficult to get via snmp info
> about phisical eg. eth1, but I have there subinterfaces which I
> _have_to_ monitor, and I have to do that fast. Any ideas?
> please, help
> thanks in advance,
> Piotr Kowalczyk, KoBa ISP