splitice / ipstats

Per IP address bandwidth statistics

ipstats

High Performance per IP address (and protocol) bandwidth statistics supporting IPv4 & IPv6 addressing.

Example Output

#TIMESTAMP DIRECTION IP TCP UDP GRE IPIP ICMP IPSEC OTHER
1461988630 IN 192.249.60.42 0 0 5 240 0 0 0 0 0 0 0 0 0 0
1461988630 OUT 192.249.60.42 0 0 0 0 0 0 0 0 0 0 0 0 0 0

IP 1.2.3.4 has sent no traffic, however it has received 100 TCP packets, totalling 5552 bytes. Counters are implemented using a 32 bit unsigned integer for packets and bytes bytes.

Usage

ipstats [device]

ipstats listens on a given device. all can be specified to listen to all interfaces. Multiple devices can be supplied if compile with PF_RING support.

Installation

ipstats can be compiled using the included Makefile. PF_RING is required. A helper script to compile and install pf_ring has been included (see contrib)

Performance

On a reasonable Xeon the CPU usage is minimal (at 30mbit). CPU As measured on a Intel(R) Atom(TM) CPU D525 @ 1.80GHz: <0.5% CPU usage at 20mbit

CPU Usage can be decreased by increasing the sampling rate.

ipstats's Issues

Not compiling and running

Tried compiling and running this and it just sat at 100% CPU usage and didn't output anything.

Tried it with both PF_RING and without it.

Added Latency

When running this it adds quite a bit of latency (tested with pf_ring). When using a TCPPing script on it, the first packet took 1second to complete while the others took ~100ms. It caused a lot of lag, I'm not sure where the issue could originate but I just wanted to bring it to your attention.

Monitor based on destination address

Hi,

Is it possible to make this monitor based on destination addresses as well? Doing something along the lines of adding BPF filters for the destination addresses so you can monitor traffic on the main interface to certain destinations (find bandwidth hogs)?