Sorry if this is a repeat. I looked the the archives and did not locate it.

Started a new thread for pmacct - hope that was OK. This is continued from: https://lists.ipfire.org/pipermail/development/2021-January/009174.html https://lists.ipfire.org/pipermail/development/2021-January/009174.html

...

Remains the question, do we need such a tool for measuring IP traffic for a certain ( all ) client(s) in the local network(s).

We do not urgently need it, but I would like to have that feature at some point.

I would like it to monitor all traffic though without adding any hosts first, because then we can simply do more with the data. This will be slightly tricky with many hosts, but it isn’t impossible when designed well. There is pmacct which seems to be a good basis to start from without reinventing the wheel and it looks like it performs much better than iptables rules. But I have never actually built it.

Michael, I’ve been using pmacct on & off since Oct 2019. There is information here:

https://community.ipfire.org/t/pmacct-a-lightweight-passive-network-monitori... https://community.ipfire.org/t/pmacct-a-lightweight-passive-network-monitoring-tool/47

My Use Case: I’ve been over-running our data caps for a year and I wanted to track down the main problem(s). I had a good idea of the problem devices but I wanted to be sure. AND I am a big fan of "You can't fix what you can't track". So that means these type of metrics.

Hopefully the above thread will give you an idea about pmacct.

Regards, Jon