RE: mrtg/snmp/subinterfaces

From: Burton M. Strauss III (BStrauss_at_acm.org)
Date: 06/06/04

  • Next message: Bryce Porter: "RE: mrtg/snmp/subinterfaces" 
    To: "Piotr Kowalczyk" <pikov@piasta.pl>, <focus-linux@securityfocus.com>
Date: Sun, 6 Jun 2004 07:36:17 -0500

    You are going to find that to be difficult or impossible.

    The standard library, libpcap (http://www.tcpdump.org), that most tools use,
    does a physical capture and so does not differentiate between the logical
    interfaces.

    It's then up to the tool to figure out which interface a packet 'came in on'
    and that's hard. It's easy to split 'em up by network address (based on the
    virtual ip address), but what about the broadcasts???

    Ultimately, most tools just choose to ignore it and report traffic on
    'eth1'.

    If it's critical to you, the only ways I know to solve this are:

    1) grab one of the multiport cards and use multiple physical interfaces.
    2) Use VLANs - but that's setting yourself up for other pain.

    -----Burton

    US-based commercial support for ntop:
         http://www.ntopsupport.com
         mailto:info@ntopsupport.com

    Search the ntop mailing lists at gmane:
         http://search.gmane.org

    (nearly current) ntop FAQ including "HowTo Ask for Help" at
         http://www.ntopsupport.com/faq.html

    > -----Original Message-----
    > From: Piotr Kowalczyk [mailto:pikov@piasta.pl]
    > Sent: Friday, June 04, 2004 4:34 AM
    > To: focus-linux@securityfocus.com
    > Subject: mrtg/snmp/subinterfaces
    >
    >
    > Hello,
    > Tell me, is there any reasonable way to monitor subinterfaces
    > utilization on linux router? It's not difficult to get via snmp info
    > about phisical eg. eth1, but I have there subinterfaces which I
    > _have_to_ monitor, and I have to do that fast. Any ideas?
    > please, help
    > thanks in advance,
    >
    > Piotr Kowalczyk, KoBa ISP

  • Next message: Bryce Porter: "RE: mrtg/snmp/subinterfaces"