[mrtg] Graph By Port

[Steve Shipway]

> Is is possible to graph an entire LAN  and/or an Internet Connection
> and graph by Port?

Yes, but... you need to have some way of obtaining this data.  MRTG can
theoretically graph anything, you just need to give it the figures.

To obtain this sort of data, you need to have TCP-level analysis of the
data packets, which means something like an RMAN probe on the network.
You can also obtain this data by creative use of the Linux firewall and
the per-rule counters it keeps (this is what I do at home to track kids'
internet usage).  It is not a project for the novice, though.

An RMAN probe can obtain this sort of data, and can be added to some
high-end routers/switches but you need to investigate how to configure
it and how to extract the data to give to MRTG.

> Most the graphing I see is all In vs. Out green and blue

This is because this is the default colour scheme, and the default thing
to graph is network interface traffic.  You can override the colours if
you want, or specify other OIDs to graph, or even give an external
script to provide the data (see the MRTG manuals)

> Is there a way to have  pkts/sec
> green = Port 80
> blue  = Port 25
> red   = Port 21
> etc.... ?
> Can this be done?

You can change the colours for the two metrics being graphed.

If using the routers2 frontend (or a custom frontend) you can merge
multiple Target[]s onto a single graph in stacked more, for example:

http://www.steveshipway.org/cgi-bin/routers2.pl?rtr=hosts%2Fhost-a.cfg&x
gtype=d&if=_CPU

(This shows a CPU graph with user, system and wait states from separate
Target[]s as stacked areas on a single graph)

All this is possible but it's a fair amount of work and requires some
knowledge of MRTG and network devices.  I don't know if anyone has so
far written up detailed instructions, and I don't have time to do so
myself :)

I'm planning to organise a MRTG/RRD-BoF session at LISA'08 (unless
someone else beats me to it).  Ask me there, I'll have more than enough
time...

Steve