OpenBSD's pf and traffic

[Michal Mertl]

Eugene M. Minkovskii píše v ne 20. 03. 2005 v 12:31 +0300:
> Hello!
> 
> Does any body know, how can I use OpenBSD's pf (packet filter) for
> determine total traffic volume on network interface? If it's
> impossible, what facility you recommend me to do this?
> 

I don't know much about pf, but I use ipfw and /usr/ports/sysutils/ipa
for the purpose. Works very well for me. IPFW itself has counters but
ipa makes the stats persist across reboots and changes to the ruleset.
Be carefull not to reconfigure ipfw from under running ipa - it will
think the counters overflowed and add huge numbers to the last known
value. Additionally ipa can do much more than just simple counters.

I configure it like this:

ipfw:
100 add allow all from any to any in via xl0
110 add allow all from any to any out via xl0

ipa(/usr/local/etc/ipa.conf):
rule xl0-in {
    ipfw = 100
    info = Incoming traffic for xl0
}
rule xl0-out {
    ipfw = 110
    info = Outgoing traffic for xl0
}

HTH

Michal Mertl