Show bandwidth usage by IP address (through pf)

[Oliver Fromme]

Maxim Khitrov <mkhitrov at gmail.com> wrote:
 > I have pf filtering traffic to our network. Is there any easy way to
 > see the current bandwidth usage sorted by ip? Someone is using up
 > almost 100% of total bandwidth and parsing "pfctl -ss -v" isn't
 > getting me anywhere.

The trafshow tool (ports/net/trafshow) does exactly that.

The nice thing about it is that it accepts the same filter
expressions that tcpdump accepts, so you can easily filter
by ports, addresses, interfaces, protocols and so on.

It works independent from your packet filter, so it doesn't
matter whether you use pf, ipf, ipfw or none at all.

If you want to see the amount of accumulated traffic (i.e.
since boot) per interface and per IP address, the commands
"netstat -i" and "netstat -ib" will tell that (in packets
and in bytes, respectively).

Best regards
   Oliver

-- 
Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing b. M.
Handelsregister: Registergericht Muenchen, HRA 74606,  Geschäftsfuehrung:
secnetix Verwaltungsgesellsch. mbH, Handelsregister: Registergericht Mün-
chen, HRB 125758,  Geschäftsführer: Maik Bachmann, Olaf Erb, Ralf Gebhart

FreeBSD-Dienstleistungen, -Produkte und mehr:  http://www.secnetix.de/bsd

One Unix to rule them all, One Resolver to find them,
One IP to bring them all and in the zone to bind them.