ipac is a package which is designed to gather, summarize and nicely output the IP accounting data. ipac make summaries and graphs as ascii text and/or gif images with graphs.

ipac...

• is for Linux
• runs on top of the ipfwadm or ipchains tool
• needs certain kernel parts compiled in
• only supports ipchains based kernels (it has a big brother for iptables called ipac-ng which is close enough)

Note: linux kernel 2.2 used ipchains, 2.4 uses iptables.

HOW DOES IT WORK?

ipac consists of two scripts (shell and perl) and one C program:

• ipacset reads a configuration file and sets up ip accounting for the kernel using ipfwadm or ipchains
• fetchipac, executed from cron once in a while, reads the current ip accounting data assembled by the kernel and writes it to a new file
• ipacsum(8) summarizes the data from a set of files and, optionally, replaces these files by one. It displays the values as a simple table containing the sums, as png graph pictures or as ascii graph pictures.

ipac rules

If you're running debian, the config file format is slightly different to newer versions. You don't have ipacin/out/fwin etc, you just have 'in' and 'out', and both in and out get called on the forward chain.

If you're running ipac on a machine that is a gateway between two networks, you will find that your totals are largely irrelevant because if I download 2Mb of stuff, I will get 2Mb in on the external interface and then 2Mb out on the internal interface.

The easiest way around this is to simply monitor your external interface. You really don't care about internal traffic because it's all free.

Edit /etc/ipac-ng/ipac.conf and replace the +'s with 'eth1' or 'ppp0' etc.

Graphing ipac

The manual page for ipacsum(8).

Start with something simple like this

1. ipacsum --png /home/crb/public_html --png-average-curve 15 --png-index index.html \

--png-caption-in-index --png-width 695 -s 24h

Perhaps you'd rather use MRTG? See http://www.saas.nsw.edu.au/solutions/ipac-2-mrtg.html.

Part of CategoryNetworking