http://lupe.praga.org.ar/wacko/DevPraga/Trafflogger History/revisions of PragaOrgAr/DevPraga/Trafflogger en-us http://lupe.praga.org.ar/wacko/DevPraga/Trafflogger/show?time= <a name="h63-1"></a><h1>Trafflogger <span class="missingpage">(Versión Español)</span><a href="http://lupe.praga.org.ar/wacko/Trafflogger/Esp/edit?add=1" title="Crear esta página">?</a></h1> <br /><a name="p63-1"></a><p class="auto" id="p63-1"> <!--notypo--><fieldset><legend><strong> Contenido </strong></legend><div class="toc1"><a href="#h63-2">News</a></div><div class="toc1"><a href="#h63-3">Description</a></div><div class="toc1"><a href="#h63-4">Features</a></div><div class="toc1"><a href="#h63-5">Samples and&nbsp;Screens</a></div><div class="toc1"><a href="#h63-6">Download</a></div><div class="toc1"><a href="#h63-7">Tips & Tricks</a></div><div class="toc1"><a href="#h63-8">Thanks go&nbsp;to...</a></div><div class="toc1"><a href="#h63-9">Autors</a></div></fieldset><!--/notypo--></p><a name="h63-2"></a><h2>News</h2> <ul><li> 23.07.2004 01:15 &#150; trafflogger 0.8.1 released, dynamic ip&nbsp;support added </li><li> 13.03.2005 18:05 &#150; trafflogger 0.8.<nobr>1&#0150;1</nobr> released, bugfix: no&nbsp;graphic for&nbsp;ppp ifaces</li></ul> <a name="h63-3"></a><h2>Description</h2><a name="p63-2"></a><p class="auto" id="p63-2"> This is&nbsp;a conf based traffic logger, each conf log&nbsp;in/out traffic for:</p><ul><li> some definable hosts </li><li> in&nbsp;a definable device </li><li> which match a&nbsp;(optional) definable pcap filter</li></ul> <br /><a name="p63-3"></a><p class="auto" id="p63-3"> All&nbsp;the logged data can&nbsp;be&nbsp;displayed (actually graphed) via&nbsp;a&nbsp;web cgi. <br /> So&nbsp;you can&nbsp;get golbal view of&nbsp;your network load and&nbsp;either get&nbsp;a&nbsp;closer look for&nbsp;any of&nbsp;the hosts(very usefull if&nbsp;you are&nbsp;a&nbsp;[mini|wanabe]ISP). Keep in&nbsp;mind that you&nbsp;can make multiples confs for&nbsp;the same host/s, changing only de&nbsp;pcap rule, doing this you&nbsp;are taking photos of&nbsp;your network from multiples angles. You&nbsp;can make a&nbsp;conf to&nbsp;log web&nbsp;traffic, otherone to&nbsp;log mail traffic, and&nbsp;otherone to&nbsp;log kazaa traffic, and&nbsp;finally one&nbsp;to&nbsp;log all&nbsp;traffic. You&nbsp;can also use&nbsp;pcap filter to&nbsp;discrime unwanted traffic for&nbsp;a&nbsp;specific conf. <strong>Very flexible ah?</strong></p><a name="h63-4"></a><h2>Features</h2> <ul><li> Coded in&nbsp;<a href="http://www.perl.com/" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">Perl</a> </li><li> <a href="http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">rrdtool</a> powered </li><li> <a href="http://www.tcpdump.org/" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">libpcap</a> powered </li><li> log&nbsp;ip&nbsp;traffic </li><li> traffic grapher/analyzer </li><li> web&nbsp;output </li><li> dynamic ip&nbsp;support</li></ul> <a name="h63-5"></a><h2>Samples and&nbsp;Screens</h2> <div class="indent"><a href="http://www.vita.com.ar/cgi-bin/traffic.pl" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">http://www.vita.com.ar/cgi-bin/traffic.pl</a><br /> <span class="missingpage">Some Screens</span><a href="http://lupe.praga.org.ar/wacko/Trafflogger/Screens/edit?add=1" title="Crear esta página">?</a></div> <a name="h63-6"></a><h2>Download</h2> <br /> <ul><li>Current </li></ul><div class="indent"><a href="http://www.praga.org.ar/dev/trafflogger/trafflogger-0.8.1-1.tar.gz" target="_blank" title="" class="outerlink"><img src="http://lupe.praga.org.ar/wacko/themes/default/icons/file.gif" alt="" border="0" /><nobr>trafflogger-0</nobr>.8.<nobr>1&#0150;1</nobr>.tar.gz</a> Source Tarball<br /> <a href="http://www.praga.org.ar/dev/trafflogger/trafflogger_0.8.1-1_all.deb" target="_blank" title="" class="outerlink"><img src="http://lupe.praga.org.ar/wacko/themes/default/icons/file.gif" alt="" border="0" />trafflogger_0.8.<nobr>1&#0150;1</nobr>_all.deb</a> Debian Package </div> <br /> <ul><li> Old&nbsp;</li></ul><div class="indent"><a href="http://www.praga.org.ar/dev/trafflogger/trafflogger-0.8.1.tar.gz" target="_blank" title="" class="outerlink"><img src="http://lupe.praga.org.ar/wacko/themes/default/icons/file.gif" alt="" border="0" /><nobr>trafflogger-0</nobr>.8.1.tar.gz</a> Source Tarball<br /> <a href="http://www.praga.org.ar/dev/trafflogger/trafflogger_0.8.1_all.deb" target="_blank" title="" class="outerlink"><img src="http://lupe.praga.org.ar/wacko/themes/default/icons/file.gif" alt="" border="0" />trafflogger_0.8.1_all.deb</a> Debian Package</div> <a name="h63-7"></a><h2>Tips & Tricks</h2> <ul><li> If&nbsp;the trafflogger web&nbsp;page are&nbsp;going to&nbsp;habe a&nbsp;lot of&nbsp;visits, then may&nbsp;be&nbsp;intresting to&nbsp;use apache with <a href="http://perl.apache.org/" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">mod_perl</a>; this make apache load perl interpeter only one&nbsp;time (now embebed in&nbsp;apache), and&nbsp;makes your program to&nbsp;be compiled only the&nbsp;first execution time, after this, the&nbsp;program is&nbsp;a binary in&nbsp;the apache perl cache, whichs ends in&nbsp;a huge perfomance increment (up to&nbsp;one thousend percent). The&nbsp;<nobr>perl-cgi</nobr> that comes with trafflogger was&nbsp;tested against apache 1.3 and&nbsp;mod_perl 1, in&nbsp;a debian stable. </li><li> If&nbsp;the trafflogger daemon has&nbsp;a&nbsp;lot of&nbsp;configurations and&nbsp;this puts your cpu&nbsp;under heavy load averge, then you&nbsp;can try&nbsp;<a href="http://www.perl.com/doc/manual/html/utils/perlcc.html" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">perlcc</a>; which is&nbsp;a <nobr>perl-bytecode</nobr> generator (among other things). I&nbsp;tested it&nbsp;with perlcc of&nbsp;debian unstable and&nbsp;work(perlcc -B trafflogger.pl), but&nbsp;whit debian stable's perlcc not. There is&nbsp;a plan to&nbsp;port trafflogger into C/C++, the&nbsp;pcacp API&nbsp;is&nbsp;the same, but&nbsp;i&nbsp;need some free time.</li></ul> <a name="h63-8"></a><h2>Thanks go&nbsp;to...</h2> <ul><li> <a href="http://www.sistecomza.com.ar" target="_blank" title="Vinculo externo (en nueva ventana)" class="outerlink">Sistecom S.A.</a>, pepole who&nbsp;actually has&nbsp;the need of&nbsp;trafflogger and&nbsp;pay part of&nbsp;the development </li></ul><div class="indent">9 de&nbsp;Julio 1257 Piso: 10 Dpto: 108 &#8211; Phone: +54 261 420 0997</div><a name="h63-9"></a><h2>Autors</h2> <div class="indent">Luciano Ruete &#150; luciano at&nbsp;praga org&nbsp;ar&nbsp;(apologies for&nbsp;my&nbsp;limited english)</div> <br />