This could be easily achieved via SNMP. If you're running Linux you can setup network counters in NetFilter like:
# WEB Traffic
iptables -I FORWARD -s $localnet -d 0/0 -p tcp --dport 80
iptables -I FORWARD -s 0/0 -d $localnet -p tcp --dport 80
After that you can see something like (for the purpose of example I'm using INPUT chain):
root@green:~# iptables -L INPUT -n -v
Chain INPUT (policy ACCEPT 1265 packets, 181K bytes)
pkts bytes target prot opt in out source destination
170 30091 tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
root@green:~#
Whit a little help of AWK you can make a script that will get bytes value:
Create a file.sh and put that command in it. After that extend your SNMP functionality by adding a line like such in snmpd.conf:
extend webtraf /bin/sh /path/to/file.sh
Don't forget to restart your snmpd. Then call snmpwalk:
snmpwalk -v 2c -c community IP.ADD.RE.SS iso.3.6.1.4.1.8072.1.3.2.4.1.2
It should return something similar to
iso.3.6.1.4.1.8072.1.3.2.4.1.2.7.119.101.98.116.114.97.102.1 = STRING: "313K"
And voila - this is the web traffic counter. After that you can easily create DCI with SNMP and put this OID to get the value.
I hope you've got the idea
I guess there are other ways of getting that traffic but I can't think of any right now.
Cheers,
Iliyan
