Non-routed traffic monitor???
 

Is there a way I can set up SuSe on my network so it doesn't route, just has 2 NICs and will monitor the throughput with ntop? I have ntop set up and everything but I would rather not set it up to route if I could help it. Any help is greatly appreciated!

Hi,

yes you can... I see 2 different ways:

1/ If the switch where your Suse is plugged in is manageable, there may be the possibility to duplicate all traffic going to the gateway and to send the "copy" to the suse box. Thus you do not interfere with the "real" traffic but can monitor it.

2/ You can set up a bridge on your Suse: packets will be forwarded from a NIC to the other. This can be done transparently (you don't even need an IP address). Just google for transparent bridge, you'll find plenty of doc.

See you !

Thanks a lot. I did find a few docs about bridging but can't get it to work so I must be doing something wrong. I'm using brcfg to configure a bridge, setting interfaces IPs to 0.0.0.0, and activating the bridge. Do I have to set up routes of any sort or should this thing just work? I want to use ntop to collect traffic. I've tried some step-by-step directions and those didn't work either so I'm just curious as to what I'm doing wrong since I'm pretty new to Linux. Thanks!

Hi,

I use brctl to configure bridges, that's the replacement tool for brcfg.
Have you set up the bridge iface after configuring it... ? I mean that you have to do an explicit
ifconfig br0 up (with an IP if you want to have one)
so that the bridge works.

As for routing is concerned, you don't have to do anything, since the bridge is a layer 2 device, that's a level beyond routing.

There's an ethernet bridging option in the kernel... make sure you've compiled it either static or as a module (in which case you've got to load it of course).

I have used ntop 2 years ago, don't remember how I made it work...

I'm running SuSe 9.3 I think. Is there a way to see if it's already enabled in the kernel? I'm sorry, as a correction to my last post, I am using BRCTL and I have used ifconfig trafmon up to enable it. I can do a brctl show trafmon and all that but I can't plug one computer into one NIC, and plug the other end into my network and receive an IP address via DHCP on the computer so I guess something isnt' working right. I'm trying to set this up in a test environment before I deploy it. Thanks!