[150420] in North American Network Operators' Group
Re: Network Traffic Collection
daemon@ATHENA.MIT.EDU (Maverick)
Thu Feb 23 15:20:14 2012
In-Reply-To: <4F469E1B.1040100@unfix.org>
Date: Thu, 23 Feb 2012 15:19:24 -0500
From: Maverick <myeaddress@gmail.com>
To: Jeroen Massar <jeroen@unfix.org>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
I want to be able to see information like how much traffic an ip send
over a period of time, what machines it talked to etc from this
perspective it should be IP based but I would really like to know how
other people do it.
Best,
Ali
On Thu, Feb 23, 2012 at 3:14 PM, Jeroen Massar <jeroen@unfix.org> wrote:
> On 2012-02-23 21:11 , Maverick wrote:
>> Hello,
>>
>> I am trying to collect traffic traffic from pcap file and store it in
>> a database but really confused how to organize it. Should I organize
>> it on connection basis/ flow basis or IP basis.
>>
>> It might be an effort to write a customized traffic analysis tool like
>> wireshark with only required functionality. I would really appreciate
>> if someone can give me direction on write way of organizing the data
>> because right now I only see individual packets and no way of putting
>> them in some order.
>
> Does this all not completely depend on what you actually want to do with
> it? You might want to start there instead of the other way around.
>
> Greets,
> =A0Jeroen
>
