root@tst:/usr # portsnap fetch update root@tst:/usr # portmaster net-mgmt/ng_ipacct
Для подсчета трафика с прокси Squid, нужно доставить calamaris:
root@tst:/usr # portmaster www/calamaris
Ядро дефолтное – все подгружается модулями.
Снимать статистику нужно на двух интерфейсах rl0 – LAN, re0 – WAN.
Правим /usr/local/etc/ng_ipacct.conf, строки начинающиеся на “ng_ipacct_xl0_” копируем в самый низ конфига (2 раза) и меняем _xl0_ на _rl0_ и re0.
svm@ring:/usr/local/etc# cat ng_ipacct.conf | grep "^[^#]" ng_ipacct_enable="YES" ng_ipacct_modules_load="YES" ng_ipacct_modules_list="netgraph ng_ether ng_ipacct" ng_ipacct_interfaces="rl0 re0" ng_ipacct_default_ether_start=' mkpeer %%iface%%: tee lower right name %%iface%%:lower %%iface%%_tee connect %%iface%%: lower upper left mkpeer %%iface%%_tee: ipacct right2left %%iface%%_in name %%iface%%_tee:right2left %%iface%%_ip_acct connect %%iface%%_tee: %%iface%%_ip_acct: left2right %%iface%%_out ' ng_ipacct_default_ether_stop=' shutdown %%iface%%_ip_acct: shutdown %%iface%%_tee: shutdown %%iface%%: ' ng_ipacct_bpf_ether_start=' mkpeer %%iface%%: tee lower right name %%iface%%:lower %%iface%%_tee connect %%iface%%: lower upper left mkpeer %%iface%%_tee: bpf right2left %%iface%%_in name %%iface%%_tee:right2left %%iface%%_bpf connect %%iface%%_tee: right2left left2right %%iface%%_out mkpeer %%iface%%_bpf: ipacct %%iface%%_match_in %%iface%%_in name %%iface%%_bpf:%%iface%%_match_in %%iface%%_ip_acct connect %%iface%%_bpf: %%iface%%_ip_acct: %%iface%%_match_out %%iface%%_out ' ng_ipacct_bpf_ether_stop=' shutdown %%iface%%_ip_acct: shutdown %%iface%%_bpf: shutdown %%iface%%_tee: shutdown %%iface%%: ' ng_ipacct_xl0_dlt="EN10MB" # required line; see ipacctctl(8) ng_ipacct_xl0_threshold="15000" # '5000' by default ng_ipacct_xl0_verbose="yes" # 'yes' by default ng_ipacct_xl0_saveuid="yes" # 'no' by default ng_ipacct_xl0_savetime="no" # 'no' by default ng_ipacct_xl0_start=${ng_ipacct_default_ether_start} ng_ipacct_xl0_stop=${ng_ipacct_default_ether_stop} ng_ipacct_xl0_checkpoint_script="path/to/your/script --checkpoint-and-save xl0" # this script is called on "stop" (to save accumulated # data) or via "rc.d/ng_ipacct.sh checkpoint" ng_ipacct_cx0_dlt="RAW" ng_ipacct_cx0_start=' mkpeer %%iface%%: cisco rawdata downstream name %%iface%%:rawdata %%iface%%_hdlc mkpeer %%iface%%_hdlc: tee inet left name %%iface%%_hdlc:inet %%iface%%_tee mkpeer %%iface%%_tee: iface right inet mkpeer %%iface%%_tee: ipacct right2left %%iface%%_in name %%iface%%_tee:right2left %%iface%%_ip_acct connect %%iface%%_tee: %%iface%%_ip_acct: left2right %%iface%%_out ' ng_ipacct_cx0_stop=' shutdown %%iface%%_ip_acct: shutdown %%iface%%_tee: shutdown %%iface%%_hdlc: ' ng_ipacct_vpn0_dlt="RAW" ng_ipacct_vpn0_start=' mkpeer ipacct dummy dummy name .:dummy %%iface%%_ip_acct mkpeer %%iface%%_ip_acct: ksocket %%iface%%_in inet/raw/divert name %%iface%%_ip_acct:%%iface%%_in ks_%%iface%%_in msg ks_%%iface%%_in: bind inet/0.0.0.0:4001 mkpeer %%iface%%_ip_acct: ksocket %%iface%%_out inet/raw/divert name %%iface%%_ip_acct:%%iface%%_out ks_%%iface%%_out msg ks_%%iface%%_out: bind inet/0.0.0.0:4002 rmhook .:dummy ' ng_ipacct_vpn0_stop=' shutdown %%iface%%_ip_acct: ' ng_ipacct_xl0_dlt="EN10MB" # required line; see ipacctctl(8) ng_ipacct_xl0_threshold="15000" # '5000' by default ng_ipacct_xl0_verbose="yes" # 'yes' by default ng_ipacct_xl0_saveuid="yes" # 'no' by default ng_ipacct_xl0_savetime="no" # 'no' by default ng_ipacct_xl0_start=${ng_ipacct_bpf_ether_start} ng_ipacct_xl0_stop=${ng_ipacct_bpf_ether_stop} ng_ipacct_xl0_checkpoint_script="path/to/your/script --checkpoint-and-save xl0" # this script is called on "stop" (to save accumulated # data) or via "rc.d/ng_ipacct.sh checkpoint" ng_ipacct_xl0_afterstart_script="path/to/your/script --load-bpf-filters xl0" # this script is called just after initialization # of nodes to load filters into xl0_bpf ng_ipacct_ks_start=' mkpeer ipacct dummy dummy name .:dummy %%iface%%_ip_acct mkpeer %%iface%%_ip_acct: tee %%iface%%_in left2right name %%iface%%_ip_acct:%%iface%%_in %%iface%%_tee_in mkpeer %%iface%%_ip_acct: tee %%iface%%_out left2right name %%iface%%_ip_acct:%%iface%%_out %%iface%%_tee_out mkpeer %%iface%%_tee_in: echo right in name %%iface%%_tee_in:right %%iface%%_echo_in mkpeer %%iface%%_tee_out: echo right out name %%iface%%_tee_out:right %%iface%%_echo_out mkpeer %%iface%%_tee_in: ksocket left inet/raw/divert name %%iface%%_tee_in:left %%iface%%_ks_in msg %%iface%%_ks_in: bind inet/0.0.0.0:4001 mkpeer %%iface%%_tee_out: ksocket left inet/raw/divert name %%iface%%_tee_out:left %%iface%%_ks_out msg %%iface%%_ks_out: bind inet/0.0.0.0:4002 rmhook .:dummy ' ng_ipacct_ks_stop=' shutdown %%iface%%_ks_in: shutdown %%iface%%_ks_out: shutdown %%iface%%_tee_in: shutdown %%iface%%_tee_out: ' ng_ipacct_ks_dlt="RAW" # required line; see ipacctctl(8) ng_ipacct_ks_threshold="15000" # '5000' by default ng_ipacct_ks_verbose="yes" # 'yes' by default ng_ipacct_ks_saveuid="yes" # 'no' by default ng_ipacct_ks_savetime="no" # 'no' by default ng_ipacct_ks_checkpoint_script="path/to/your/script --checkpoint-and-save ks" # this script is called on "stop" (to save accumulated # data) or via "rc.d/ng_ipacct.sh checkpoint" ng_ipacct_rl0_dlt="EN10MB" # required line; see ipacctctl(8) ng_ipacct_rl0_threshold="15000" # '5000' by default ng_ipacct_rl0_verbose="yes" # 'yes' by default ng_ipacct_rl0_saveuid="no" # 'no' by default ng_ipacct_rl0_savetime="yes" # 'no' by default ng_ipacct_rl0_start=${ng_ipacct_default_ether_start} ng_ipacct_rl0_stop=${ng_ipacct_default_ether_stop} ng_ipacct_rl0_checkpoint_script="/usr/sut/ipacct.sh rl0" # this script is called on "stop" (to save accumulated # data) or via "rc.d/ng_ipacct.sh checkpoint" ng_ipacct_re0_dlt="EN10MB" # required line; see ipacctctl(8) ng_ipacct_re0_threshold="15000" # '5000' by default ng_ipacct_re0_verbose="yes" # 'yes' by default ng_ipacct_re0_saveuid="no" # 'no' by default ng_ipacct_re0_savetime="yes" # 'no' by default ng_ipacct_re0_start=${ng_ipacct_default_ether_start} ng_ipacct_re0_stop=${ng_ipacct_default_ether_stop} ng_ipacct_re0_checkpoint_script="/usr/sut/ipacct.sh re0" # this script is called on "stop" (to save accumulated # data) or via "rc.d/ng_ipacct.sh checkpoint"
mkdir /usr/sut
Там же создаем скрипты и файлы для работы нашей системы
root@tst:/usr/sut # touch daily_istat.pl daily_pstat.pl daily_sumnp.pl daily_traf.sh ipacct.sh ipbas ipbase ipblan ipbreal ipmac.base
где *.pl и *.sh рабочие скрипты, а файлы вида ip* – список IP адресов сети.
Наполняем скрипты:
root@ring:/usr/sut # cat ipacct.sh
#!/bin/sh
# /usr/sut/ipacct.sh
IPACCTCTL="/usr/local/sbin/ipacctctl"
INTERFACES="rl0"
IFACE=$1
DIR=/usr/sut/ipacct
if [ ! -e "DIR" ]; then
mkdir $DIR
fi
NAME="traf.log"
NAMEI=$NAME.$IFACE
for IFACE in $INTERFACES; do
$IPACCTCTL ${IFACE}_ip_acct:$IFACE checkpoint
$IPACCTCTL ${IFACE}_ip_acct:$IFACE show >> $DIR/$NAMEI
$IPACCTCTL ${IFACE}_ip_acct:$IFACE clear
done
dp=`/bin/date +%y%m%d-%H:%M`
messag=`/usr/bin/tail -1 $DIR/$NAMEI | /usr/bin/fgrep exceed`
if [ "$messag" ]; then
echo "$dp $messag" >> /usr/sut/ipacct/alarm.$IFACE
fi
root@ring:/usr/sut # cat daily_istat.pl #!/usr/local/bin/perl # # /usr/sut/daily_istat.pl (daily_istat.pl interface) # --interface "re0-inet, rl0-lan" $iface1 = "re0"; $net1 = "194.44."; $iface2 = "rl0"; $net2 = "192.168."; #$net2 = /[0-9].[0-9]./; $iface = shift(@ARGV); if ($iface eq $iface1) { $ipi = "ipbreal"; $net = $net1; } if ($iface eq $iface2) { $ipi = "ipblan"; $net = $net2; } open (Fip, "/usr/sut/ipmac.base"); open (Fipi, ">/usr/sut/$ipi"); open (Fipii, ">/usr/sut/ipbas"); open (Fipiii, ">/usr/sut/ipbase"); $i = 0; $j = 0; while ($line = <Fip>) { ($p1,$xlam) = split(' ',$line,2); if ($p1 =~ /$net/) { print Fipi "$i $p1\n"; print Fipii "$i $p1\n"; $i = $i + 1; } $j = $j + 1; print Fipiii "$j $p1\n"; } $count = $i; close (Fip); close (Fipi); close (Fipii); close (Fipiii); #goto Z1; open (Fy, "/usr/sut/workyer"); chomp($y = <Fy>); close (Fy); open (Fm, "/usr/sut/workmon"); chomp($m = <Fm>); close (Fm); open (Fd, "/usr/sut/workday"); chomp($d = <Fd>); close (Fd); Z1: goto Z2; $y = "13"; $m = "08"; $d = "30"; Z2: open (Fipii, "/usr/sut/ipbas"); @mip = <Fipii>; close (Fipii); $infile = "/usr/sut/$y.$m/$y$m$d.$iface"; open (InF, "$infile"); for ($i = 0; $i < $count; $i++) { $ipin[$i] = 0; $ipout[$i] = 0; $ipsum[$i] = 0; } while ($line = <InF>) { ($p1,$p2,$p3,$p4,$p5,$p6,$p7,$p8) = split(/ /,$line,8); foreach $str (@mip) { chomp($str); ($i,$ip) = split(/ /,$str,2); if ($p1 eq $ip) { $ipin[$i] = $ipin[$i] + $p7; } if ($p3 eq $ip) { $ipout[$i] = $ipout[$i] + $p7; } } } close (InF); #--------------------------------- #goto ZZ; open (TrF, ">>$infile.o"); $sumfile = "/usr/sut/$y.$m/tsum$y$m.$iface"; open (TrSum, ">>$sumfile"); $Mb = 1048576; #$Mb = 10; for ($i = 0; $i < $count; $i++) { $str = @mip[$i]; chomp($str); ($xlam,$ip) = split(/ /,$str,2); $ipin[$i] = int ($ipin[$i] / $Mb); $ipout[$i] = int ($ipout[$i] / $Mb); $ipsum[$i] = $ipin[$i] + $ipout[$i]; if ($ipsum[$i] > 0) { printf TrF ("%-15s%15d%15d%15d\n", $ip, $ipin[$i], $ipout[$i], $ipsum[$i]); if ($d eq "01") { printf TrSum ("%-15s%15d%15d%15d\n", $ip, $ipin[$i], $ipout[$i], $ipsum[$i]); } } } close (TrF); close (TrSum); if ($d eq "01") { goto ZZ; } #goto ZZ; open (TekF, "/usr/sut/$y.$m/$y$m$d.$iface.o"); @mt = <TekF>; close (TekF); open (SumF, "/usr/sut/$y.$m/tsum$y$m.$iface"); @mts = <SumF>; close (SumF); open (SumF, "+>/usr/sut/$y.$m/tsum$y$m.$iface"); for ($k = 0; $k < $count; $k++) { $str = @mip[$k]; chomp($str); ($k,$ip) = split(/ /,$str,2); for ($i = 0; $i < $count; $i++) { $line1 = @mts[$i]; # $line1 = @m[$i]; ($ip1,$in1,$out1,$sum1) = split(/ +/,$line1,4); $line2 = @mt[$i]; ($ip2,$in2,$out2,$sum2) = split(/ +/,$line2,4); if ($ip eq $ip1) { $ins[$k] = $ins[$k] + $in1; $outs[$k] = $outs[$k] + $out1; $sums[$k] = $sums[$k] + $sum1; } if ($ip eq $ip2) { $ins[$k] = $ins[$k] + $in2; $outs[$k] = $outs[$k] + $out2; $sums[$k] = $sums[$k] + $sum2; } } if ($sums[$k] > 0) { printf SumF ("%-15s%15d%15d%15d\n", $ip, $ins[$k], $outs[$k], $sums[$k]); } } close (SumF); ZZ: #END
root@ring:/usr/sut # cat daily_pstat.pl
#!/usr/local/bin/perl
#
# /usr/sut/daily_pstat.pl
#
#goto Z1;
open (Fy, "/usr/sut/workyer");
chomp($y = <Fy>);
close (Fy);
open (Fm, "/usr/sut/workmon");
chomp($m = <Fm>);
close (Fm);
open (Fd, "/usr/sut/workday");
chomp($d = <Fd>);
close (Fd);
Z1:
goto Z2;
$y = "13";
$m = "08";
$d = "30";
Z2:
$file = "$y$m$d";
@temp = `cat /usr/sut/$y.$m/$file.log | \
/usr/local/bin/calamaris -n -r -1 -S 14 -O -U M`;
$i = 0;
foreach $line (@temp) {
${ip[$i]} = substr($line,0,16);
${byte[$i]} = substr($line,51,8);
$i++;
}
$n = $i-7;
open (FH,">/usr/sut/$y.$m/$file.log.o");
print FH $temp[1];
print FH $temp[2];
print FH $temp[3];
print FH $temp[4];
print FH $temp[5];
print FH $temp[6];
for ($k = 7; $k<$n; $k++) {
print FH ${ip[$k]},${byte[$k]},"\n";
}
close (FH);
open (IpF, "/usr/sut/ipblan");
@mip = <IpF>;
close (IpF);
$infile = "/usr/sut/$y.$m/$y$m$d.log.o";
open (InF, "$infile");
@mp = <InF>;
close (InF);
$outfile = "/usr/sut/$y.$m/tsum$y$m.log";
open (OutF, "$outfile");
@msum = <OutF>;
close (OutF);
$outfile = "/usr/sut/$y.$m/tsum$y$m.log";
open (OutF, "+>$outfile");
#print "$y $m $d $infile $outfile\n";
#goto ZZ;
foreach $str (@mip) {
chomp($str);
($i,$ip) = split(/ /,$str,2);
$ipsums[$i] = 0;
foreach $strs (@msum) {
($ips,$ipsum) = split(/ +/,$strs,2);
if ($ip eq $ips) {
$ipsums[$i] = $ipsum;
}
}
foreach $line (@mp) {
($p1,$p2) = split(/ /,$line,2);
$p2 =~ tr/M\n/ /;
if ($ip eq $p1 & $p2 > 0) {
$ipsums[$i] = $ipsums[$i] + $p2;
if ($d eq "01") {
printf OutF ("%-15s%15d\n", $ip, $p2);
}
}
}
if ($d ne "01" & $ipsums[$i] > 0) {
printf OutF ("%-15s%15d\n", $ip, $ipsums[$i]);
}
}
close (OutF);
ZZ:
#END
root@ring:/usr/sut # cat daily_sumnp.pl #!/usr/local/bin/perl # Proxy + NAT # /usr/sut/sum_n_p.pl $iface = "rl0"; #goto Z1; open (Fy, "/usr/sut/workyer"); chomp($y = <Fy>); close (Fy); open (Fm, "/usr/sut/workmon"); chomp($m = <Fm>); close (Fm); open (Fd, "/usr/sut/workday"); chomp($d = <Fd>); close (Fd); Z1: goto Z2; $y = "13"; $m = "08"; $d = "30"; Z2: open (IpF, "/usr/sut/ipblan"); @mip = <IpF>; close (IpF); $infile1 = "/usr/sut/$y.$m/tsum$y$m.log"; open (InF1, "$infile1"); @mproxy = <InF1>; close (InF1); $infile2 = "/usr/sut/$y.$m/tsum$y$m.$iface"; open (InF2, "$infile2"); @mnat = <InF2>; close (InF2); $outfile = "/usr/sut/$y.$m/sumnp$y$m"; open (OutF, "+>$outfile"); #print "$y $m $d\n $infile1\n $infile2\n $outfile\n"; #goto ZZ; #--------------- $trafproxy = 0; $trafnat = 0; $traflan = 0; $trafproxyr = 0; $trafnatr = 0; $traflanr = 0; foreach $str (@mip) { chomp($str); ($i,$ip) = split(/ /,$str,2); $tsum[$i] = 0; $tproxyp[$i] = 0; $tsump[$i] = 0; foreach $linep (@mproxy) { ($ipp,$tproxy) = split(/ +/,$linep,2); if ($ip eq $ipp) { $tsum[$i] = $tproxy; $tproxyp[$i] = $tproxy; } } foreach $linen (@mnat) { ($ipn,$inn,$outn,$sumn) = split(/ +/,$linen,4); if ($ip eq $ipn) { $tsum[$i] = $tsum[$i] + $sumn; $tsump[$i] = $sumn; } } if ($ip =~ /192.168./) { $trafproxy = $trafproxy + $tproxyp[$i]; $trafnat = $trafnat + $tsump[$i]; $traflan = $traflan + $tsum[$i]; } if ($ip =~ /194.***./) { $trafproxyr = $trafproxyr + $tproxyp[$i]; $trafnatr = $trafnatr + $tsump[$i]; $traflanr = $traflanr + $tsum[$i]; } $trafproxys = $trafproxy + $trafproxyr; $trafnats = $trafnat + $trafnatr; $traflans = $traflan + $trafnatr; if ($tsum[$i] > 0) { printf OutF ("%-15s%15d%15d%15d\n", $ip, $tproxyp[$i], $tsump[$i], $tsum[$i]); } } printf OutF ("%-15s%15d%15d%15d\n", "L Pr Nat Summ", $trafproxy, $trafnat, $traflan); printf OutF ("%-15s%15d%15d%15d\n", "R Pr Nat Summ", $trafproxyr, $trafnatr, $traflanr); printf OutF ("%-15s%15d%15d%15d\n", "LR Pr Nat Summ", $trafproxys, $trafnats, $traflans); close (OutF); ZZ: `cp $outfile /usr/sut/traffic`; #END
root@ring:/usr/sut # cat daily_traf.sh #!/bin/sh # /usr/sut/daily_traf.sh # Interfaces (out - WAN, in - LAN) if_out='re0' if_in='rl0' y=`/bin/date +%y` m=`/bin/date +%m` d=`/bin/date +%d` echo "$y" > /usr/sut/workyer echo "$m" > /usr/sut/workmon echo "$d" > /usr/sut/workday DIR=/usr/sut/$y.$m if [ ! -e "DIR" ]; then mkdir $DIR fi mv /usr/sut/ipacct/traf.log.$if_out $DIR/$y$m$d.$if_out mv /usr/sut/ipacct/traf.log.$if_in $DIR/$y$m$d.$if_in if [ -e /usr/sut/ipacct/alarm.$if_out ]; then mv /usr/sut/ipacct/alarm.$if_out /usr/sut/ipacct/a$y$m$d.$if_out fi if [ -e /usr/sut/ipacct/alarm.$if_in ]; then mv /usr/sut/ipacct/alarm.$if_in /usr/sut/ipacct/a$y$m$d.$if_in fi cp /var/log/squid/access.log $DIR/$y$m$d.log #cp /dev/null /var/log/squid/access.log
Теперь рабочие файлы:
root@ring:/usr/sut # cat ipbas 0 192.168.113.0 1 192.168.113.1 2 192.168.113.2 ..................... 255 192.168.113.255
root@ring:/usr/sut # less ipbase 1 192.168.113.0 2 192.168.113.1 3 192.168.113.2 4 192.168.113.3 5 192.168.113.4 ......................... 255 192.168.113.254 256 192.168.113.255 257 194.***.***.**1 258 194.***.***.**2 259 194.***.***.**3
root@ring:/usr/sut # cat ipblan 0 192.168.113.0 1 192.168.113.1 ................... 253 192.168.113.253 254 192.168.113.254 255 192.168.113.255
root@ring:/usr/sut # cat ipbreal 0 194.***.***.*** 1 194.***.***.*** 2 194.***.***.*** 3 194.***.***.***
root@ring:/usr/sut # cat ipmac.base 192.168.113.0 sn 00 001 ----- ---- 192.168.113.1 mc 68:05:ca:02:06:62 00 002 g0309 1496 roller 192.168.113.2 bl 00 192.168.113.3 bl 00 192.168.113.4 bl 00 192.168.113.5 bl 00 192.168.113.6 bl 00 192.168.113.7 mc 00:07:e9:b8:ad:ee 00 024 g0310 ---- pktn ......................................
Добавляем в крон
root@ring:/usr/sut # cat /etc/crontab SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin MAILTO="" #minute hour mday month wday who command # */4 * * * * root /usr/local/etc/rc.d/ng_ipacct checkpoint > /dev/null 59 23 * * * root /usr/sut/daily_traf.sh 10 0 * * * root /usr/sut/daily_istat.pl re0 20 0 * * * root /usr/sut/daily_istat.pl rl0 30 0 * * * root /usr/sut/daily_pstat.pl 1 4 * * * root /usr/sut/daily_sumnp.pl
Проверка:
root@ring:/usr/sut # ngctl ls There are 10 total nodes: Name: ngctl4605 Type: socket ID: 000001e2 Num hooks: 0 Name: mpd658-lso Type: socket ID: 00000003 Num hooks: 0 Name: mpd658-cso Type: socket ID: 00000004 Num hooks: 0 Name: mpd658-eso Type: socket ID: 00000005 Num hooks: 0 Name: re0 Type: ether ID: 00000006 Num hooks: 2 Name: rl0 Type: ether ID: 00000007 Num hooks: 2 Name: rl0_tee Type: tee ID: 00000009 Num hooks: 4 Name: rl0_ip_acct Type: ipacct ID: 0000000a Num hooks: 2 Name: re0_tee Type: tee ID: 00000012 Num hooks: 4 Name: re0_ip_acct Type: ipacct ID: 00000013 Num hooks: 2
root@ring:/usr/sut # kldstat Id Refs Address Size Name 1 46 0xffffffff80200000 1f6e480 kernel 2 1 0xffffffff82170000 316728 zfs.ko 3 2 0xffffffff82487000 cb78 opensolaris.ko 4 4 0xffffffff82494000 44bd8 ipfw.ko 5 1 0xffffffff824d9000 9bd0 ipfw_nat.ko 6 2 0xffffffff824e3000 17288 libalias.ko 7 1 0xffffffff824fb000 28dd0 dummynet.ko 8 1 0xffffffff82524000 8d40 ipdivert.ko 9 1 0xffffffff82621000 2986 uhid.ko 10 1 0xffffffff82624000 39cc ng_socket.ko 11 5 0xffffffff82628000 c57d netgraph.ko 12 1 0xffffffff82635000 42ab ng_mppc.ko 13 1 0xffffffff8263a000 81f rc4.ko 14 1 0xffffffff8263b000 43da ng_ether.ko 15 1 0xffffffff82640000 17db ng_ipacct.ko 16 1 0xffffffff82642000 17ce ng_tee.ko
Пример лога (файл вида /usr/sut/18.04/180408.re0):
Адр. источника Порт Адр. получателя Порт № прот. Пакетов Байт 192.168.113.11 5230 192.168.113.1 3551 6 2 92 -1 192.168.113.11 5230 192.168.113.1 3551 6 4 168 0 192.168.113.11 5225 192.168.113.1 3551 6 2 92 -1 192.168.113.11 5225 192.168.113.1 3551 6 4 168 0 192.168.113.11 5223 192.168.113.1 3551 6 2 92 -1 192.168.113.11 5223 192.168.113.1 3551 6 4 168 0 192.168.113.17 50646 193.47.166.29 123 17 1 76 -1 192.168.113.11 5233 192.168.113.1 3551 6 2 92 -1 192.168.113.11 5233 192.168.113.1 3551 6 4 168 0 192.168.113.11 4427 92.157.81.29 28858 6 3 471 -1 10.90.90.90 0 239.255.255.100 0 2 2 184 0 192.168.113.11 5213 34.252.56.124 443 6 8 2664 100
где – номер протокола (описываются в /etc/protocols)
