Monitoring IPv4 vs IPv6 Traffic

ipv6network-monitoring

We have a fully functional dual-stack network running in our business. Has anyone found a simple tool for monitoring IPv4 vs IPv6 traffic ratios on a given host? When I say "simple" I'm thinking a daemon/service similar to 'vnstat'

A perfect report in it's simplest form would look something like this:

                 Total     IPv4          IPv6          Ratio
This Month:      300gb     100gb (33%)   200gb (66%)   1:2
This Week:       5gb       1gb (20%)     4gb (80%)     1:4
Today:           1.2gb     400mb (33%)   800mb (66%)   1:2

Forgive me if any of my maths is wrong, that's why I want a tool 😉

I'm primarily interested in Linux (CentOS 6) hosts, but any Windows (2008R2) tools would be useful too.

I found a thread suggesting netstat -s -6 | grep -i octets but the -6 option is invalid on CentOS 6; I'm guessing it's a recent addition to netstat.

Best Answer

I'm already doing this, and have been for some time, using munin and a custom plugin I wrote myself, which gets data from iptables audit rules. It's running on a C6 box so you should be able to fork-lift it into place if no-one has any better ideas. It's not the simple one-liner you wanted, but it's working, and produces data like these:

munin graph of network throughput

The plugin is simple enough, it just takes data from two flat files created in /var/tmp:

#!/bin/bash
#
# (c) Gatekeeper Technology Ltd., 2013
# May be used under the terms of GPLv3 or, at your discretion, any later version

if [ "$1" = "config" ]; then

    echo 'graph_title Network Throughput'
    echo 'graph_category network'
    echo 'graph_info This is the total throughput on the NIC since the beginning of the calendar month, or the last reboot, whichever was mo
st recent.'
    echo 'graph_vlabel bytes'
    echo 'graph_args --logarithmic'
    echo 'in4.label       in v4'
    echo 'in4.colour      ff0000'
    echo 'out4.label      out v4'
    echo 'out4.colour     00ff00'
    echo 'in6.label       in v6'
    echo 'in6.colour      aa0088'
    echo 'out6.label      out v6'
    echo 'out6.colour     00aa88'
    echo 'total.label     total'
    echo 'total.colour    0000ff'
    exit 0
fi

out=`head -3 /var/tmp/audit.out.counts | tail -1 | awk '{print $2}'`
echo "out4.value $out"
in=`head -3 /var/tmp/audit.in.counts | tail -1 | awk '{print $2}'`
echo "in4.value $in"

out6=`head -3 /var/tmp/audit.out.v6.counts | tail -1 | awk '{print $2}'`
echo "out6.value $out6"
in6=`head -3 /var/tmp/audit.in.v6.counts | tail -1 | awk '{print $2}'`
echo "in6.value $in6"

total=$(($in+$out+$in6+$out6))
echo "total.value $total"

The crontab entry that makes them looks like this:

# output the audit rule counts for munin purposes
* * * * *  /sbin/iptables  -L AUDIT-I -n -x -v > /var/tmp/audit.in.counts
* * * * *  /sbin/iptables  -L AUDIT-O -n -x -v > /var/tmp/audit.out.counts
* * * * *  /sbin/ip6tables -L AUDIT-I -n -x -v > /var/tmp/audit.in.v6.counts
* * * * *  /sbin/ip6tables -L AUDIT-O -n -x -v > /var/tmp/audit.out.v6.counts
# and zero the counts once a month
0 0 1 * *  /sbin/iptables  -Z AUDIT-I
0 0 1 * *  /sbin/iptables  -Z AUDIT-O
0 0 1 * *  /sbin/ip6tables -Z AUDIT-I
0 0 1 * *  /sbin/ip6tables -Z AUDIT-O

and the iptables rules are made with the following /etc/sysconfig/iptables rules:

:AUDIT-I - [0:0]
:AUDIT-O - [0:0]
# audit input traffic
-A INPUT -i eth0 -j AUDIT-I
 [ALL OTHER INPUT RULES APPEAR HERE, AFTER THE AUDIT RULE]
# audit outbound traffic
-A OUTPUT -o eth0 -j AUDIT-O
 [ALL OTHER OUTPUT RULES APPEAR HERE, AFTER THE AUDIT RULE]
# AUDIT rules
-A AUDIT-I -p all
-A AUDIT-O -p all

The reason crontab is involved is to stop the munin plugin needing to run with root privileges; if you didn't mind it doing that, you could have the plugin get the packet counts directly, by invoking iptables itself.

The counts don't survive a reboot (hence the extra drop down to zero in the graph above), but if you have your server set up to save iptables rules and packet counts on reboot, this wouldn't affect you.

Related Topic