Greetings

Once again i need your opinions.

I have a firewall, an embedded low spec system (Alix 2D13), which runs Centos.
All my firewalling is done with IPtables and what i need now is a network traffic monitor tool that whenever i wish, i will navigate to a folder and grab a nice file containing all network traffic log...say for example :

SSH 20MB
SMTP 50MB

..e.t.c

I asked my friend Google and found out that some people create custom scripts and log their traffic via iptables whereas other people use tools like:

ntop
nethogs

i would like to ask:
1) what is the best solution considering the fact that:

a) the tool needs to be lightweight due to low cpu and memory
b) i am not an advance shell programmer
c) It must allways running in the background

2) Say i decide to use a tool, is ntop and nethogs best solution?

thanks

i heard that you can use iptable to log to syslog