TrafMeter :: TrafMeter

What is TrafMeter?

Your organization is connected to the Internet, but can you ensure that it is used appropriately and effectively? Do you want to monitor and count the IP traffic between your local area network (LAN) and Internet?

TrafMeter is a Windows-based tool providing realtime traffic accounting and monitoring. You can use it to count useful traffic of your computer (it's free!) or use to build the traffic accounting system for all PCs in your office LAN.

TrafMeter key features:

  • Unlimited number of filters for captured traffic, defining network packets which are used for tracking/reporting.
  • Creation of rulesets for various monitoring purposes. The rulesets can be used for single hosts, subnets, as well as specific groups of hosts - i.e. all hosts in/not in your LAN, specific IP protocols (ICMP,TCP,UDP,OSPF,etc).
  • TCP/UDP port filtering.
  • Real-time presentation of traffic activity via graphical charts. Each filter is represented by a unique color, which allows the webmaster and/or administrator to easily 'see' the Internet connection usage of individual users.
  • Real-time bandwidth usage of the filtered packets via graphical charts.
  • Report generation via XML.
  • Recording Traffic Counters into the more common database such as Microsoft SQL Server, Microsot Access, MySQL and etc (not available in Lite version).
  • Tracking network packets for the different filters, letting you analyze and comment on the monitored traffic which may include MAC addresses from Ethernet headers and the ToS field from IP headers (not available in Lite version).
  • HTTP Host Header Logging (not available in Lite version).
  • Counting unencrypted VPN packets
  • Packet filtering firewall

TrafMeter webpage: www.trafmeter.com


TrafMeter :: License agreement

This End-User License Agreement ("EULA") is a legal agreement between you, either an individual or a single entity, ("LICENSEE") and Marel IT Solutions ("LICENSOR").

The license agreement includes computer software and may include associated media and online or electronic documentation ("SOFTWARE PRODUCT"). Please read the following terms and conditions before installing the SOFTWARE PRODUCT. By installing or using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. If you do not agree to the terms of this EULA, do not install or use the SOFTWARE PRODUCT.

Copyright laws and international copyright treaties, as well as other intellectual property laws and treaties protect the SOFTWARE PRODUCT.

The SOFTWARE PRODUCT is licensed, not sold.

GRANT OF LICENSE
This EULA grants you the following rights:

USE AND COPY
You may install SOFTWARE PRODUCT on no more than one machine per valid license or as defined by purchased licenses. You may make other copies of the SOFTWARE PRODUCT for backup and archival purposes.

LICENSE TYPES
SOFTWARE PRODUCT is licensed on a RUN-TIME basis, which means, that for each machine on which SOFTWARE PRODUCT is installed, a valid run-time license must exist. Software licenses are provided as unique registration codes and/or serial numbers used to remove time-out settings in the software.

Single License
Allows installation and execution of SOFTWARE PRODUCT on a single machine per license.

Site License
Allows installation and execution of SOFTWARE PRODUCT on multiple machines within a single physical location (i.e. an office or data center location at a single physical address)

RESTRICTIONS
Unregistered versions (shareware licensed copies) of the SOFTWARE PRODUCT may be used for an unlimited period but you are allowed to use only three traffic filters.

You must maintain all copyright notices on all copies of the SOFTWARE PRODUCT.

You may not sell copies of the SOFTWARE PRODUCT to third parties without express written consent of THE LICENSOR and under THE LICENSOR's instruction.

EVALUATION copies may distributed freely without charge so long as the SOFTWARE PRODUCT remains whole including but not limited to existing copyright notices, installation and setup utilities, help files, licensing agreement, run-time libraries, etc. and DOES NOT CONTAIN either valid serial numbers or illegal serial numbers. In executing such an act, or similar copyright or license violation, to the maximum extent permitted by applicable law you may be held liable for loss of revenue to THE LICENSOR or THE LICENSOR's representatives due to loss of sales or devaluation of the SOFTWARE PRODUCT or both.

You may not rent, lease, lend, copy, modify, sub-license or time-share the SOFTWARE PRODUCT. You may not reverse engineer, decompile or disassemble or otherwise alter the SOFTWARE PRODUCT or its documentation. You may not use a Registration Key Code issued to another user for use in conjunction with the SOFTWARE PRODUCT.

You may permanently transfer all of your rights under this EULA only in conjunction with a permanent transfer of your validly licensed copy of the product(s).

You must comply with all applicable laws regarding the use of the SOFTWARE PRODUCT.

You may not execute this software on more than ONE machine per valid license except as outlined under GRANT OF LICENSE - use and copy.

TERMINATION
THE LICENSOR may terminate this EULA if you fail to comply with the terms and conditions of this EULA. In such event, you must destroy all copies of the SOFTWARE PRODUCT.

COPYRIGHT.
All title and copyrights and intellectual property rights in and to the SOFTWARE PRODUCT and any copies thereof are owned by THE LICENSOR.

NO WARRANTY
ANY USE OF THE SOFTWARE PRODUCT IS AT YOUR OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE AUTHOR DISCLAIMS ALL WARRANTIES AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.

NO LIABILITY FOR CONSEQUENTIAL DAMAGES.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF, MIS-USE OF OR INABILITY TO USE THE SOFTWARE PRODUCT, EVEN IF THE AUTHOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

LIMITATION OF LIABILITY.
THE AUTHOR'S ENTIRE LIABILITY AND YOUR EXCLUSIVE REMEDY UNDER THIS EULA SHALL NOT EXCEED ONE DOLLAR (US$1.00).


TrafMeter :: Customize

Customize TrafMeter!

We can customize TrafMeter for your requirements (in other words, we can include specific features by your request). Customization costs $10 per hour. Send us email for further details.


TrafMeter :: Versions

TrafMeter is available in three editions:

 | TrafMeter Freeware | TrafMeter Lite | TrafMeter
Capturing Traffic | yes | yes | yes
Traffic Reports | yes | yes | yes
Recording Traffic Counters into a database | depending on package | no | yes
Packets Logging into a plaintext file or into a database | depending on package | no | yes
Host Header Logging (allows tracking visited websites) | depending on package | no | yes
Number of traffic filters | 3 | Unlimited | Unlimited
Price per single license | 0 | 29 USD | 69 USD

The latest versions of TrafMeter can be downloaded from official website: http://www.trafmeter.com

Note

  • Only one instance of the TrafMeter Service can be running at any time on one PC.


TrafMeter :: Registration info

How to order TrafMeter

After you download and install TrafMeter, you have unlimited days to try the product but you are allowed to use only three traffic filter. To remove this restriction you should purchase a license.

For fastest delivery please order online using your creditcard. To do so, please choose an ORDER link below. Your software will usually be delivered within 1-2 days! We also offer the following alternatives to order your license:

  • CREDIT CARD by FAX
  • CREDIT CARD by PHONE
  • PRO-FORMA INVOICE by CHECK or WIRE
  • CHECK by US or UK checks or International Money Orders

Orders are processed by SWREG www.swreg.org

 | TrafMeter Lite | TrafMeter
Single license Allows installation and execution of TrafMeter on a single machine per license. | $29 ORDER | $69 ORDER
Site license Allows installation and execution of TrafMeter on multiple machines within a single physical location (i.e. an office or data center location at a single physical address) | $149 ORDER | $345 ORDER


TrafMeter :: How To Contact Us

How To Contact Us

If you have any comments, suggestions, or bug reports with regard to TrafMeter, please send us an e-mail support@trafmeter.com

If your question is about technical support, please attach in your message the follows (please, zip files before sending via email):

  • a file "support.txt" from TrafMeter Service startup folder
    (by default, c:\program files\TrafMeter\support.txt)
  • application logs of TrafMeter Service
    (by default, c:\program files\TrafMeter\Logs\Log*.txt)
  • your filterset
    (by default, c:\program files\TrafMeter\FilterSets\default.tmf)
  • any additional information about your network will be useful as well

Postal address:
MAREL IT solutions
Rosenweg 5d
A-6923 Lauterach

Telefon +43(5574)86011
Telefax +43(5574)86012


TrafMeter :: Requirements

System requirements
  • Pentium-based CPU, 32 MB RAM
  • Microsoft Windows 98/ME/NT/2000/XP/2003
  • Microsoft Internet Explorer 5.0+ (5.5 recommended) suggested for XML reports


TrafMeter :: Introduction

Introduction

There are many reasons why you want to take control of the traffic in your LAN using TrafMeter, for example:

  • You want to measure the speed between the two hosts in the network to detect a bottleneck
  • You want to always know who uses your Internet connection the most
  • You want to get monthly or daily reports of your Internet connection usage

How does TrafMeter work ?

TrafMeter captures raw data from a network card, analyzes every captured packet and updates the counters of traffic filters according user-defined rules. TrafMeter has a powerful filter engine, allowing you to count only the useful traffic.

The Filterset

The filterset is a main unit in TrafMeter. It contains the filters for counting custom traffic, various settings for making XML Traffic Reports, the settings for recording packets and HTTP Host Headers into a database and etc. The filterset is stored in an XML file witn the extension *.tmf. Due to the filterset isn't bound to a specific network adapter, you can share the filterset between computers in your network.

The Filters

Every filter has its own ruleset, a 64-bit sent bytes counter, a 64-bit received bytes counter and an independent packet collector. The traffic counters will be updated if a captured packet satisfies at least one of the rules with actions "Count" or "Count and Pass" listed in the filter.

The Rule

The rule is the lowest level in the TrafMeter hierarchy. The rule includes the conditions which, will be checked to make a decision "Does the captured packet satisfy this rule or not?".


TrafMeter :: Installation Package

Installation Package

TrafMeter installation package includes several programs:

  • TrafMeter Service (trafsvc.exe) - this is a kernel of TrafMeter. TrafMeter Service captures and analyzes the network traffic, updates the traffic counters and creates the traffic reports. TrafMeter Service runs as a regular Win32-application (not recommended on Windows 2000/XP/2003) or as a Windows 2000/XP/2003 Service (to run before a user logon).
  • TrafMeter Administrative Console (trafadmin.exe) - this is a tool for managing the TrafMeter Service settings. It includes Filterset Editor, Graph for visual representation of the captured packets, Viewer for TrafMeter Service Events and etc.
  • TrafMeter Service Monitor (trafmonitor.exe) monitors a capture status of TrafMeter Service and displays it in the system tray
  • Tool for resetting traffic counters (trafreset.exe) - this allows zeroing the traffic counters in the filterset. TrafReset.exe can be launched manually and using the Windows Scheduler.

TrafMeter Installation Wizard will copy all of the necessary files and ask to reboot your computer. You must reboot the computer after the TrafMeter installation.


TrafMeter :: TrafMeter installation Guide

TrafMeter Installation Guide

This Guide will help you to determine the optimum location for TrafMeter in order to count the traffic between your computer network and the Internet.

Simple network configuration

In a small- or medium-sized organization, the computer network may consist of only one Ethernet segment which all workstation computers are connected to, often by means of a network Ethernet hub. Ethernet segment may be connected to the Internet by an access router/gateway/firewall device, as shown in Figure 1.

For simple network configurations, install TrafMeter on a computer connected to Ethernet hub carrying all traffic to and from the Internet gateway and enable promiscuous mode on the network adapter.

If gateway is a Windows-based computer with proxy-server software (e.g. Microsoft ISA Server, WinRoute, WinGate and etc.), you can install TrafMeter on this computer.

Switched networks

The network described in Figure 1 uses a non-switching Ethernet network hub to connect the workstations to the access router. In this scenario, all data generated by the workstations will be delivered to the TrafMeter computer.

In a switched network, a network switch (or an Ethernet switch) is used to "segment" the network, to reduce the network loading by blocking some data from the network branches that do not require that data.

If an unmanaged network switch is used, it is not possible to connect the TrafMeter computer directly to the switch (even though all data passes through the switch) and an additional network hub must be installed between the switch and the access router, to provide data to TrafMeter. This case is shown in Figure 3.

If a managed (or an intelligent) switch is used, you can configure the switch to deliver all IP data to a "monitor" (or "spanning") port on the switch, connect the TrafMeter computer to this port and enable the promiscuous mode on the Ethernet adapter. This case is shown in Figure 4.


TrafMeter :: Connect

Opening the TrafMeter Service configuration

TrafMeter consists of several programs. TrafMeter Service contains its own configuration to perform the actual traffic capture. It works in the background and has no window on Desktop. To open the Service configuration, start TrafMeter Administrative Console and use the command "Service" -> "Connect" from the menu or use the button [image] on the toolbar.

Note

  • By default, the TrafMeter Service password is blank. It is strongly recommended to change this password.
  • TrafMeter Service allows remote configuring, so you can open the Service configuration over network.
  • TrafMeter Service listens to the TCP port 7643 for incoming connections from TrafMeter Administrative Console.
  • For security reasons, TrafMeter Service may accept incoming connections from TrafMeter Administrative Console only on single specific address. The address should belong to this PC, otherwise you may not connect to the Service (See "Options" dialog in TrafMeter Administrative Console).
  • TrafMeter Service can serve only one connection with TrafMeter Adminstation Console.


TrafMeter :: Selecting NIC

Selecting Network Interface Card (NIC)

Selecting NIC for the traffic capture is a very important step in the TrafMeter Service configuration. A dialog for selecting the network adapters is available when you are connected to TrafMeter Service and when the capture status is not "In capture".

Note

  • You are allowed to select several network adapters simultaneously for the traffic capture.
  • For better performance, don't select the network adapters whose the traffic will not be accounted.
  • The network adapter may have several IP addresses, but you will see only one IP address in the network adapters selecting dialog.
  • Some network adapters based on chip RTL8139, can be displayed as "NDIS 5.0". Never mind, this is a normal behavior of TrafMeter.


TrafMeter :: Capturing the traffic

Capturing the traffic

TrafMeter Service has two capture states: In capture, No capture. You can change the capture state from TrafMeter Administrative Console connected with TrafMeter Service. The network traffic capture can be started if at least one network adapter is selected for capturing and the filterset is loaded into TrafMeter Service with at least one traffic filter.

Managing the capture states

  • To start the capture use command "Traffic" -> "Start capture" from the TrafMeter Administrative Console menu or use button [image] on the toolbar
  • To stop the capture use command "Traffic" -> "Stop capture" from the TrafMeter Administrative Console menu or use button [image] on the toolbar

Note

  • TrafMeter Service attempts to start the capture automatically after Service startup.


TrafMeter :: Service Monitor

As TrafMeter Service works in the background and doesn't have its own window, it is very important to track the TrafMeter Service status. You are allowed to use two ways of the TrafMeter Service status monitoring.

Using TrafMeter Service Monitor

TrafMeter Service Monitor displays the status of TrafMeter Service in the system tray.

TrafMeter Service is capturing the traffic
TrafMeter Service is pausing the traffic capture
TrafMeter Service is not capturing the traffic
TrafMeter Service is not responding or a communication error has occurred

Using Microsoft Internet Explorer

Launch Microsoft Internet Explorer and type in the URL http://your_TrafMeter_host:7643. You will see the following:


TrafMeter :: Architecture

Processing the captured packet in TrafMeter

There are three processing levels of the captured packet in TrafMeter: the Filterset Level, the Filter Level and the Rule Level.

The Rule Level

All of rule's conditions must be valid for the captured packet in order for it to satisfy the rule. This case is called "Rule Match" and this rule is called "Matched Rule".

The Filter Level

The TrafMeter Filter may include unlimited number of rules. At least one rule, listed in the filter, must satisfy the captured packet, in order to satisfy the filter. Processing the captured packet at the filter level starts from the first rule until Rule Match. If Matched Rule has the actions "Count" or "Count and Pass", the sent bytes counter or the received bytes counter will be increased by the total length of the current packet.

The Filterset Level

The captured packet will be processed by the filters included in the filterset, from the first filter until the last filter. The captured packet will be processed by the next filter, if:

  • The captured packet has not satisfied at least one rule, listed in the filter
  • The Matched Rule has the action "Count"

TrafMeter will stop processing the captured packet, if:

  • The Matched Rule has the action "Pass" or "Count and Pass"
  • The Matched Rule has the action "Deny". In this case, a firewall will block the captured packet (valid only in Active Capture Mode). The action "Deny" is similar to the action "Pass" in Passive Capture Mode.


TrafMeter :: Logging the Application Events

Logging the Application Events

TrafMeter Service records own events and error messages in two destinations simultaneoulsly: to the Windows Event Log and to the plaintext file.

Logging into the Windows Event Log

This is a built-in Windows Logging facility presented only on Microsoft Windows NT/2000/XP/2003. It provides a standard view for the application events, a powerful search engine for the events and a remote viewing. To view the TrafMeter Service Events, open "Event Viewer" (Control Panel -> Administrative Tools) and select "Application" item. You will see the TrafMeter Service Events under the TrafSvc source.

Logging into the plaintext file

This logs the TrafMeter Service Events directly into the plaintext file located in the user-defined folder (by default, %programfiles%\TrafMeter\Logs). The filename for the application log is constructed from the current date using the template "Log_yyyy_mm.txt" (where yyyy is a four-digit year and mm is a two-digit month of the year ranging from 01 to 12). When you ask for the technical support, attach the application log for the current month in your message.

You can specify the folder for the application log in the "Options" dialog box (the "Folder" tab) in TrafMeter Administrative Console.


TrafMeter :: Logging the denied packets

Logging the denied packets

In the Active Capture Mode, TrafMeter can block the captured packets if the matching rule has "Deny" action. All denied packets are recorded into the plaintext file in the user-defined folder (by default, %programfiles%\TrafMeter\Logs). The filename for the denied packets is constructed from the current date using the template "DeniedPkt_yyyy_mm.txt" (where yyyy is a four-digit year and mm is a two-digit month of the year ranging from 01 to 12).

You can specify the folder for the denied packets log in the "Options" dialog box (the "Folder" tab) in TrafMeter Administrative Console.

You may setup different levels of logging the denied packets (silent, normal and extended). See details.


TrafMeter :: Using TrafMeter as firewall

Using TrafMeter as firewall

Although TrafMeter, promoted as traffic monitoring software, is typically used in conjunction with a separate firewall, it has the capability to deny network packets, because it was built on a firewall engine.

Let's consider a typical case for building a firewall solution, using TrafMeter. For example, we have an office network whose gateway runs Windows Server 2003, with Routing enabled and Remote Access Service (RRAS) playing the NAT-router role. What packets should be denied to defend the gateway against hackers? A solution would be to restrict access to all network services, on the gateway, from any untrusted networks.

Incoming TCP-connections

According to the TCP protocol, the client initiates a connection with the server and sends the first TCP packet with the SYN flag. To restrict incoming TCP connections, it is necessary to create a rule which blocks TCP packets with a SYN flag from an untrusted network. This will defend all network services on the gateway, based on the TCP protocol.

Incoming UDP-connections

The UDP protocol is designed as connectionless, thus causing problems trying to detect the client and server sides, via packet header analysis. As rule, network services, based on the UDP protocol, use ports ranging from 1 to 1024. If you deny UDP packets where the destination address is the same as the gateway, and the destination port is in the range of 1 to 1024, this will restrict most of the incoming UDP connections. If any services use ports over 1024, you should create additional rules to handle them.

ICMP-packets

Typically, ICMP packets don't carry the same risks for intrusion, however, most firewalls like to block incoming ICMP echo request packets to prevent detecting the gateway by network scanners. TrafMeter can extract and deny ICMP echo request packets, when required.

Summary

In order to use TrafMeter as a firewall, the creation of a single filter (must be the first in the filterset) is required, using the following rules:

Filter 1. firewall
N | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action | Additional options or conditions
1 | TCP | IP addresses of WAN | Any | My computer | Any | No | Deny | SYN
2 | UDP | IP addresses of WAN | Any | My computer | 1-1024 | Yes | Deny |
3 | ICMP | IP addresses of WAN |  | My computer |  | No | Deny | Echo request

Note

  • The capturing of packets must be done in Active Capture Mode, otherwise TrafMeter will not deny the packets.
  • You should use passive FTP, if incoming TCP packets, with SYN flag, are blocked.
  • For any services on the gateway which require UDP ports over 1024, additional rules will be necessary.
  • Denied packets are logged to %programfiles%\TrafMeter\Logs.


TrafMeter :: Zeroing counters

Zeroing counters

There are three ways to zero the counters in TrafMeter: manual, automatic and using the utility TrafReset.

Manual zeroing counters

This can be done at any time when the Administrative Console is connected to the TrafMeter Service. Just select the menu item "Reset counters" or click on the corresponding button on the toolbar. You will see a dialog box to select filters for zeroing counters.

Automatic zeroing counters

Automatic zeroing can be set for each filter on a daily or monthly basis. This type of zeroing is always performed at midnight. To setup automatic zeroing, open the "Misc" tab in the Filter Editor:

Zeroing counters using the utility TrafReset

The TrafMeter installation package contains the utility TrafReset that allows the resetting of counters to zero, using a special communication protocol with the TrafMeter Service. The main advantage of using TrafReset - you can schedule it to run at any time (and with any periodicity) using the "native" Task Scheduler of Microsoft Windows. See details about using TrafReset...

Note

  • "Zeroing counters" means resetting to zero only the current values of traffic counters, which you can see in the TrafMeter Administrative Console. This doesn't change any other traffic reports in XML files or in any database.


TrafMeter :: Filter manager

Filter Manager

Filter Manager allows adding, editing, deleting the filters or modifying the filters' order in the filterset.


TrafMeter :: Filter editor

Filter Editor

Filter Editor allows managing the filter settings. You can add, modify or delete the rules here. The filter can include unlimited number of rules. The Packet Logging feature allows logging all packets matching the filter into a plaintext file or into a database. See the details...

You can invoke Filter Editor from Filter Manager

Note

  • For better performance, place the most frequently used rules on the top of the list.


TrafMeter :: Rule editor

Rule Editor

You can fill in the following rule parameters parameters here:

Rule description

The description of the rule (maximum 100 symbols). This field can stay blank.

IP protocol

Defines the name or the number of an IP protocol for the rule. See the IP protocol number article in TrafMeter Knowledge Base.

Source and Destination

These fields define a method of checking the IP addresses of the captured packets. If the captured packet is TCP or UDP, you can set the conditions to check the TCP or UDP port number.

Direction

  • If the "Direction" option is disabled, the captured packet must be matching the source and destination addresses exactly. This case is called "Direct Match". If "Direct Match" appears, the sent bytes counter will be updated.
  • If the "Direction" option is enabled, the rule will also match the captured packets with the exact opposite source and destination addresses. This option can fire two types of matching: "Direct Match" and "Mirrored Match". If "Direct Match" appears, the sent bytes counter will be updated. If "Mirrored Match" appears, the received bytes counter will be updated.

Attention! The "Direction" option is enabled by default. Unless you surely know what you are doing, leave this untouched.

TCP options (only for TCP protocol)

This allows to catch the first packet of new TCP connection (according the TCP specification, it is the packet with SYN flag and without ACK flag). The option is useful for creating firewall rules which block, for example, incoming TCP connections. This option is available only in one direction, the "Direction" flag will be disabled automatically.

ICMP options (only for ICMP protocol)

This enables checking a type of each captured ICMP packet. If captured packet is ICMP Echo Request, the match will be appeared (if other condition are valid also). This option is useful for creating firewall fules as well.

Action

The "Action" property defines what TrafMeter should do with the captured packet in case of Rule Match.

  • Count - the filter counter will be updated and the captured packet will be processed by the next filter
  • Pass (not count) - the filter counter will be not updated and the captured packet will not be processed by the next filter
  • Count and Pass - the filter counter will be updated and the captured packet will not be processed by the next filter
  • Deny - the filter counter will be not updated and the captured packet will be denied by the firewall (available only in the Active Capture mode)

These actions can be expressed in the next table as well:

Action | The counters will be updated | The captured packet will be processed by the next filter | The captured packet will be denied by firewall
Count | Yes | Yes | No
Pass (not count) | No | No | No
Count and pass | Yes | No | No
Block | No | No | Yes
No rule match | No | Yes | No

Options "The packet must be"

This defines whether the packet must be counted in the previous filter(s), not counted in the previous filter(s) or ignore this option. It is useful to prevent counting the same packet twice.

ToS (Type of Service)

This sets a condition for checking ToS (ToS is a filed located in the IP packet header). See an article about ToS in TrafMeter Knowledge Base.

Traffic counters condition

This allows setting the traffic limits for the filters (available only in Active Capture Mode). See configuration example 6.

Time-based counters conditions

This allows to define a time when the current rule will be valid.

You can invoke Rule Editor from Filter Editor.


TrafMeter :: LAT

Local Address Table (LAT)

LAT should contain all IP addresses of your Local Area Network (LAN).

With LAT, it is possible to create rules that will not count the traffic between hosts in your LAN. After having formulated LAT, you can refer to the addresses listed in LAT as "IP addresses of my LAN" and to the addresses not listed in LAT as "IP addresses of WAN" in the rules.

If LAT is blank, all IP addresses will be considered as "IP addresses of WAN". The maximum number of LAT records is unlimited. TrafMeter performance doesn't depend on number of records in LAT because TrafMeter uses fast algorithm for searching address inside LAT.

LAT must not contain overlapped ranges of IP addresses pairs.

Importing LAT

The IP addresses can be imported into LAT from an external plaintext file. Each string should contain one pair of IP addresses (the start IP address and the end IP address) separated by space. The example of such plaintext file is shown below:

192.168.1.1 192.168.1.255
192.168.50 192.168.5.255
192.168.80.2 192.168.80.63


TrafMeter :: Database Connection

Database Connection String (OLE DB Connection string)

TrafMeter can record the headers of the captured packets or write its own counters into the database. To communicate with the database, TrafMeter uses the ADO (ActiveX Data Objects) component, which is built-in in Microsoft Windows. You should specify Database Connection String in TrafMeter, if you want to use the database as a destination for any logging facility.

ADO uses the Database Connection string (OLE DB Connection string) to define the specifics of the data source. Database Connection String provides the information (in the form of parameters and their values) that is required for the server to establish the connection. Each type of the databases has a specific parameters set, which you must specify the values for; these are the required parameters. Some databases also provide the optional parameters that you can specify to implement the special features. Such a string might look like this:

SQLOLEDB.1; Password=TrafMeter; Persist Security Info=True;
User ID=TrafMeter; Initial Catalog=traffic; Data Source=SERVERNAME

A database connection string can be stored in an external file, also known as "User Data Link file" (UDL) with an extension .udl. You can use a UDL Wizard to create the UDL file. Having created the UDL file, you can refer to it in the connection string as follows:

File Name=c:\DataLinks\trafmeter.udl

If you change the database or network configuration, you can simply modify the UDL file and distribute its new version.

See also:

  • HOWTO: Creating an OLE DB Connection String for Microsoft SQL Server
  • HOWTO: Creating an OLE DB Connection String for an Access 97/2000/XP Database
  • HOWTO: Creating an OLE DB Connection String for MySQL

Note

  • To view the ADO version installed on your computer, launch TrafMeter Administrative Console, open the "About" dialog box and click the "Support Info" button
  • It is strongly recommended to use ADO 2.7 or higher with TrafMeter. The latest version of ADO (also known as MDAC) is available free for download from the Web at the following URL: http://www.microsoft.com/data


TrafMeter :: XML Traffic Reports

XML Traffic Reports

This feature provides the easiest way of building various traffic counters reports for the fixed time periods.

Why XML ?

XML is a standard language used to structure and describe the data that can be understood by different applications. The power of XML is its ability to separate the user interface from the data.

What application should I use to view XML Traffic Reports ?

Microsoft Internet Explorer.

How it works

The report accumulates the traffic counters on a monthly basic. When a new month starts, new XML Traffic Report is created automatically. Filenames for the monthly XML Traffic Reports are constructed from a four-digit year and a two-digit month of the year (ranging from 01 to 12) numbers. For example, "2003_09.xml" is a monthly report for September 2003 and "2003_10.xml" is a monthly report for October 2003. TrafMeter will create and update a "CurrentMonth.xml" file as well. This will be a copy of the XML Traffic Report for this month.

You will find an example of the XML Traffic Report here. This displays the traffic counters for the filter with id = 15. As shown there, the traffic counters are 2518192 (sent bytes counter) and 12315902 (received bytes counter) for the whole month of August 2003. Besides that, this report contains the traffic counters for the specific days. For example, the traffic for the specific day (say August 22, 2003) was 677994 (sent bytes counter) and 3510996 (received bytes counter).

For the best viewing in the browser, it is recommended to use XSL formatting for the XML Traffic Reports.

See also:

  • Using XSL formatting for XML Traffic Reports


TrafMeter :: Using XSL formatting for XML Traffic Reports

Using XSL formatting for XML Traffic Reports

XSL stands for Extensible Stylesheet Language. It is kind of the XML equivalent of Cascading Stylesheets (CSS). Since XML data by itself does not contain any information on how to render its contents, a style sheet needs to be attached to it in order to convert it into HTML, PDF, RTF, GIF or any other display format.

Here is an example of XML document produced by TrafMeter:

<?xml version="1.0"?>
<TrafficReport>
    <Filter Id="1">
        <Name>ICMP</Name>
        <Sent>7224</Sent>
        <Recv>7224</Recv>
    </Filter>
    <Filter Id="2">
        <Name>TCP</Name>
        <Sent>3566</Sent>
        <Recv>8967</Recv>
    </Filter>
    <LastModified>November, 26 2002 11:19:14</LastModified>
</TrafficReport>

If you open this document using Microsoft Internet Explorer, it will look like:

This view is not human-friendly. However, let's create XSL formatting (in a separated file traffic.xsl) for the XML document. The content of traffic.xsl is here.

Next, add a reference to the traffic.xsl in a prolog of the XML document:

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="traffic.xsl"?>
<TrafficReport>

...and we will get a human-friendly view of the XML document using Microsoft Internet Explorer:

To format the Monthly XML Traffic Reports, use XSL formatting included in the TrafMeter package.


TrafMeter :: The example of XSL formatting for XML Traffic Report

The example of XSL formatting for XML Traffic Report

<?xml version="1.0"?>
<xsl:template xmlns:xsl="uri:xsl">
  <HTML>
    <BODY>
      <H3>Your company name - Daily traffic report</H3>
<table cellspacing="0" cellpadding="5" border="1">
<tr>
    <td STYLE="font-family:Arial; font-size:12">
      Id
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Name
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Sent
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Recv
    </td>
</tr>

  <xsl:for-each select="TrafficReport/Filter">
<tr>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="@Id"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Name"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Sent"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Recv"/>
    </td>

</tr>
  </xsl:for-each>

</table>

<p> <br>
<i>Last Modified:
<xsl:value-of select="TrafficReport/LastModified"/>
</i> </br></p>

    </BODY>
  </HTML>
</xsl:template>


TrafMeter :: The example of XSL formatting for XML Montly Traffic Report

The example of XSL formatting for XML Montly Traffic Report

This XSL style sheet (month.xsl) is intended for Monthly XML Traffic Reports and allows:

  • To view the traffic counters in any traffic unit (byte, Kb, Mb, Gb)
  • To view the traffic counters for all filters and for the whole month
  • To view the traffic counters for all filters and for a specific day
  • To view the traffic counters for the specific filter and for the period from the first day of the month to the last day of the month

Here is zipped month.xsl (3kb).

The result of this XSL formatting can be as follows:


TrafMeter :: Traffic Logging into the Database

Traffic Logging into the Database (not available in Lite version)

This allows recording the traffic counters into the database and building a fast and scalable traffic accounting system for your users. To use this feature you should specify:

  • Database Connection string
  • The name of Database Table for Traffic Logging
  • The Traffic Samples parameter

What is the Traffic Samples parameter?

This sets a time interval for a single Traffic Sample. The Traffic Sample is an amount of bytes captured by the specific filter for the time interval started at the specific time.

How does TrafMeter write the counters into the database?

  1. A current value of the "ts" field is derived: 1) from a user-defined Traffic Samples parameter 2) from the current local time. For example, if the current time is 19:49 on August 22, 2003, then

    User-defined Traffic Samples | Value of ts (in the ymmddhhmi format)
    1 minute | 308221949
    5 minutes | 308221945
    15 minutes | 308221945
    30 minutes | 308221930
    1 hours | 308221900
    2 hours | 308221800
    1 day | 308220000

  2. The command "SELECT * FROM traffic_table WHERE ts=308222145" is issued and the database counters stored in the table are retrieved into a temporary counters storage.
  3. The counters, unsaved since the last database update are added to the counters stored in the temporary storage.
  4. The temporary counter storage is flushed into the database.


TrafMeter :: Table for Traffic Logging

Database table for Traffic Logging

To write traffic counters in a database, you must create a table with the minimal set of fields:

N | Field name | Field type | Description
1. | filterid | smallint | Filter id (from 1 to N. In general, N is a number of filters in the filterset)
2. | ts | int | The beginning of the time interval in the ymmddhhmi format. For example, 308220945 points to 09:45 August 22, 2003
3. | sent | bigint | Sent bytes counter
4. | recv | bigint | Received bytes counter

You can use the following script to create the table in Microsoft SQL Server:

CREATE TABLE [dbo].[traffic] (
   filterid smallint NOT NULL,
   ts int,
   sent bigint, recv bigint)

The same script works on MySQL database:

CREATE TABLE traffic (
   filterid smallint NOT NULL,

   ts int,
   sent bigint, recv bigint)

The next figure shows the table for Microsoft Access:


TrafMeter :: Packet Logging

Packet Logging (not available in Lite version)

TrafMeter can record the IP packet headers of captured traffic into a plaintext file or into a database. To implement this feature, every TrafMeter filter has a special engine named "Packet Collector". The main idea of the Packet Collector is grouping the IP packets with the identical parameters because the recording of every packet is too expensive. The Packet Collector is a storage for the counted packets and includes up to 2000 positions. The position of the Packet Collector consists of the following set of IP packet headers:

  • IP protocol type (1 - ICMP, 6 - TCP, 17 - UDP and etc.
    See c:\winnt\system32\drivers\etc\protocols.txt or RFC 1700 for details)
  • Source and destination IP addresses
  • Source and destination MAC addresses
  • Source and destination ports (for TCP and UDP only)
  • Sent bytes counter and received bytes counter
  • TOS (Type of Service) field

A process named "Flushing the Packet Collector" forces all the positions remaining in the Packet Collector to be written into the file or into the database. The Packet Collector is flushed after a fixed time period (by default, 20 seconds). Too frequent flushing may increase a system loading. Too infrequent flushing may lead to Packet Collector overflow. The Packet Collector overflow is marked in the logfiles as "Packet Collector is full" and you should consider decreasing the flushing time period.

Compressing the dynamic ports (for TCP and UDP only)

As it is well known, opening a webpage in an Internet browser may establish several TCP connections simultaneously since the webpage may have built-in graphic images. The packets of the websession have very similar characteristics that allow significantly reducing the logging amount. During the initialization of a new TCP/UDP connection, a port number is chosen at the client side from a range 1024-65535 randomly. The TCP/UDP client port number is also called "dynamic" or "client" and it is useless for the traffic accounting.

In the compressing of the dynamic ports mode (by default, it is enabled for every Packet Collector), TrafMeter will replace any dynamic port with a "magic number" 65535 before putting the captured packet in the Packet Collector.

How does TrafMeter make a decision: which port is dynamic and which port is non-dynamic?

There are two ways:

  • If one of the peers has the port from the dynamic range (1024-65535) and the other peer has the port from a non-dynamic range (1-1024), this will be the simplest case
  • For the new TCP connection, TrafMeter looks for the SYN flag. The peer sent SYN flag always initiates the new TCP connection; therefore, it will have the dynamic port number.

See also:

  • Packet Logging into the plaintext file
  • Packet Logging into the database
  • Example of usage Packet Logging in a large ISP


TrafMeter :: Packet Logging into the plaintext file

Packet Logging into the plaintext file

Packet Logging into the file provides an easy technique to track the packets, matching at least one rule listed in the filter. To use this feature you should specify a Filename Template for the logfiles. Every filter must have a unique Filename Template because it has own independent Packet Collector.

An example of the logfile is shown below. The lines beginning with '---' are the time when the Packet Collector was flushed at. The first column is the protocol type. The 2nd and 3rd columns are the source IP address and the source port. The 4th and 5th columns are the destination IP address and the destination port. The 6th and 7th columns are the sent bytes counter and the received bytes counter.

 proto    src_ip     src_port    dst_ip        dst_port     sent       recv

--- Time: 2002-11-12 11:31:14
  TCP     192.168.3.1 client    64.12.174.121     80           0         80
  TCP     192.168.3.1 client    64.236.16.136     80         160         40
  TCP     192.168.3.1 client    207.46.249.27     80          40         81
  TCP     192.168.3.1 client    64.236.16.116     80          40          0
  TCP     192.168.3.1 client   207.200.91.184     80         160         80

--- Time: 2002-11-12 11:31:32
  TCP     192.168.3.1 client    64.236.16.136     80         432        256

--- Time: 2002-11-12 11:31:50
  TCP     192.168.3.1 client  205.188.238.185    443        1573      13652
  TCP     192.168.3.1 client    64.12.174.121     80         772        330
  TCP     192.168.3.1 client    207.46.249.27     80          40         41
  TCP     192.168.3.1 client  205.188.238.185     80         733        795

If "Log additional fields" option is enabled, you can see another picture below. The value in the brackets after 2nd and 4th column contains the source and destination MAC address correspondingly. The latest column contains the value of a TOS (Type of Service) field.

--- Time: 2002-11-12 11:41:35
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)     80       11629       8154   0
  TCP     192.168.3.1 (5254ab2088ad) client     193.45.10.72 (008048c28d3d)    443          80         80   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80         567          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0       1551   16
  TCP     192.168.3.1 (5254ab2088ad) client     216.26.160.8 (008048c28d3d)    110         383        494   0
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         152        166   0

--- Time: 2002-11-12 11:41:53
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80          80          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0         40   16
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         225        412   0

Note

  • "client" in the third column means any dynamic port (1024-65535).


TrafMeter :: Filename template

Filename template

If you have daily or monthly logfiles, each logfile has, of course, a different filename that reflects the period of logging time. Filename Template allows an automatical constructing of the filenames for the logfiles and reports to simplify its rotating. The resulting filename is derived from the Filename Template based on the current system time. For example, the Filename Template:

c:\TrafMeter\Counter_%Y-%M-%d.txt

will be filename

c:\TrafMeter\Counter_2002-Jan-01.txt

if system time is 1 January 2002.

You can use the following identifiers in the Filename Template:

  • %Y - current year, 4 digits
  • %y - current year, 2 last digits
  • %m - current month, 2 digits
  • %M - current month, 3 letter (for example, Feb)
  • %d - current day, 2 digits
  • %h - current hour, 2 digits
  • %n - current minute, 2 digits

Note

  • Using Filename Template, TrafMeter can create folders with an unlimited nested level. For example, the Filename Template:

    c:\Reports\traffic\Enterprise\Departments\User1\%M\%d.txt

    will create folder c:\Reports\traffic\Enterprise\Departments\User1\Jan\


TrafMeter :: Packet Logging into the database

Packet Logging into the database

Packet Logging into database provides a powerful technique to store and to analyze the IP packets, matching at least one rule listed in the filter. To use this feature you should specify:

  • Database Connection string
  • The name of Database Table for Packet Logging
  • The method of storing the IP addresses (as char data byte, as unsigned int data type or as signed int data type)

Note

  • You should manually create the database table before TrafMeter records the packets.

The method of storing the IP addresses

  • As char data type. The fields src_ip (source IP address) and dst_ip (destination IP address) must be char(16) data type.
  • As unsigned int data type. Before recording the packet, the source and destination IP addresses are converted into 32-bit unsigned int data type. For example, the IP address 192.168.4.2 will have 3232236546 in unsigned int equivalent. This allows reducing the database used space.
  • As signed int data type. Before recording the packet, the source and destination IP addresses are converted into 32-bit signed int data type and the source and destination port number are converted into 16-bit signed int.

Note

  • Microsoft SQL Server doesn't have unsigned int data type. Use bigint data type instead or signed int data type.

See also:

  • A set of fields for the table to record the captured packets


TrafMeter :: Database Table for Packet Logging

Database Table for Packet Logging

You must manually create the table in the database before TrafMeter records the IP packets. A minimal set of the fields for the table is:

N | Name | Type | Description
1. | filterid | smallint | Filter id (from 1 to N. In general, N is a number of filters in the filterset)
2. | proto | smallint | IP protocol type (1 - ICMP, 6 - TCP, 17 - UDP and etc. See "protocols.txt" for details)
3. | src_ip | char(16) | Source address IP (in decimal-dotted notation, e.g. 192.168.3.250)
4. | src_port | int | Source port (for TCP or UDP only, the range is 0 - 65535)
5. | dst_ip | char(16) | Destination address IP
6. | dst_port | int | Destination port (for TCP or UDP only)
7. | sent | int | Sent bytes counter
8. | recv | int | Received bytes counter

In addition, if you enable logging of the MAC addresses, ToS (Type of Service) field or Filter Name in the packets database, you should create some additional fields in the table:

N | Name | Type | Description
9. | src_mac | char(16) | Source MAC address (e.g. 1a2c3e4d556f)
10. | dst_mac | char(16) | Destination MAC address
11. | tos | smallint | TOS (Type of Service) field (the range is 0-255)
12. | filtername | char(30) | The filter name (The length of this field must be the length of the longest Filter Name in the filterset)

See also:

  • Microsoft SQL Server Syntax to create the table for Packet Logging
  • MySQL Server Syntax to create the table for Packet Logging
  • Microsoft Access Syntax to create the table for Packet Logging


TrafMeter :: Microsoft SQL Server Syntax to create the table for Packet Logging

Microsoft SQL Server Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

CREATE TABLE [dbo].[packets] (
   ts datetime DEFAULT CURRENT_TIMESTAMP NOT NULL,
   filterid smallint NOT NULL,
   proto smallint,
   src_ip char(16),
   src_port int,
   dst_ip char(16),
   dst_port int,
   sent int, recv int)

To create the table for Packet Logging with additional fields:

CREATE TABLE [dbo].[packets] (
   ts datetime DEFAULT CURRENT_TIMESTAMP NOT NULL,
   filterid smallint NOT NULL,
   filtername char(30),
   proto smallint,
   tos smallint,
   src_mac char(16),
   src_ip char(16),
   src_port int,
   dst_mac char(16),
   dst_ip char(16),
   dst_port int,
   sent int, recv int)

Note

Microsoft SQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use CURRENT_TIMESTAMP function for this purpose.


TrafMeter :: MySQL Server Syntax to create the table for Packet Logging

MySQL Server Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

create table packets (
   ts timestamp,
   filterid smallint  NOT NULL,
   proto tinyint,
   src_ip char(16),
   src_port smallint unsigned,
   dst_ip char(16),
   dst_port smallint unsigned,
   sent int unsigned, recv int unsigned);

To create the table for Packet Logging with additional fields:

create table packets (
   ts timestamp,
   filterid smallint NOT NULL,
   filtername char(30),
   proto tinyint,
   tos tinyint,
   src_ip char(16),
   src_mac char(16),
   src_port smallint unsigned,
   dst_ip char(16),
   dst_mac char(16),
   dst_port smallint unsigned,
   sent int unsigned, recv int unsigned);

Note

MySQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use the field with "timestamp" type.


TrafMeter :: Packet Logging :: Microsoft Access Syntax to create the table for Packet Logging

Microsoft Access Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

To create the table for Packet Logging with additional fields:

Note

Microsoft Access must automatically insert the current date and time in the table with new record. Therefore, you should use the field with Now() function as default value.


TrafMeter :: Useful SQL scripts for analyzing the table with the captured packets

Useful SQL scripts for analyzing the table with the captured packets

TrafMeter doesn't have a native tool for building the reports from a Packet Logging database. To help in creating your custom SQL-scripts for building various reports we provide some Microsoft SQL Server examples listed below.

1. Calculating the total amount of traffic for every filter

select filterid, sum(sent),sum(recv) from packets group by filterid

2. Calculating the total amount of traffic for every filter for a specific day

select filterid as filterid, sum(sent) as sent, sum(recv) as recv from packets
   where datediff(day,'2002-11-24',ts)=0
   group by filterid
   order by filterid

3. Calculating the total amount of traffic for every filter for a specific month

select filterid as filterid, sum(sent) as sent, sum(recv) as recv from packets
   where datediff(month,'2002-11-01',ts)=0
   group by filterid
   order by filterid

4. Calculating the total amount of traffic per day for a specific filter for a specific month

Set the variable @dd to the first day of the required month.

declare @dd datetime
set @dd='2002-11-01'
select datediff(day,@dd,ts) as mday, sum(sent) as sent, sum(recv) as recv
   from packets
   where (filterid=1 AND (datediff(month,@dd,ts)=0))
   group by datediff(day,@dd,ts)
   order by datediff(day,@dd,ts)

The example above shows the dates with a zero-based index. E.g. the first day of the month will be 0, the second day of month will be 1. To avoid this problem, you can use the following script with a temporary table:

drop table #p1
go
declare @dd datetime
set @dd='2002-11-01'
select datediff(day,@dd,ts) as mday, sum(sent) as sent, sum(recv) as recv
   into #p1
   from packets
   where (filterid=1 AND (datediff(month,@dd,ts)=0))
   group by datediff(day,@dd,ts)
go
update #p1 set mday=mday+1
go
select * from #p1 order by mday

5. Calculating the total amount of traffic per host for a specific filter for a specific month

select dst_ip, sum(sent) as sent, sum(recv) as recv
   from packets
   where (filterid=1 AND (datediff(month,'2002-11-01',ts)=0))
   group by dst_ip


TrafMeter :: Host Header Logging

Host Header Logging (not available in Lite version)

This allows recording into a plaintext file or into a database the host names obtained by analyzing a content of HTTP request and an amount of transferred bytes during HTTP session. What is a difference between Host Header Logging in TrafMeter and analyzing log files of a proxy server? You will find the answer in the table below.

 | Analyzing the log files | Host Header Logging
Is the proxy server required? | Yes | No. There are cases when it is not possible to install proxy server.
Is overhead of HTTP taken into account? | No. | It is taken into account: - header of HTTP reply - headers of IP and TCP - retries of TCP segments without acknowledgement.
What size of the file is accounted in case of using gzip-encoding (compressing "on the fly" web pages)? | The size on the disk. | Effective size of transferring the file (can be in 2-4 times less when using gzip-encoding)

To enable this option, you should open Filter Editor, select the tab "Host Header Logging" and set parameters.

What types of HTTP requests are analyzed?

  1. HTTP/1.1 (RFC 2068). Each request HTTP/1.1 consists of the field "Host" contained the host name. Using this field allows to create two or more virtual web servers bound on the same IP address and on the same TCP port. The example of HTTP/1.1 request:
    GET / HTTP/1.1
Host: www.w3.org
  2. HTTP/1.0 (RFC 1945). There is no the field "Host" in HTTP/1.0, so IP address (in decimal dotted notation) will be logged instead the host name. The example of HTTP/1.0 request:
    GET / HTTP/1.0
  3. HTTP request through the proxy server. In this case, the string with HTTP request method must include the host name. The example of HTTP request through the proxy server:
    GET http://www.w3.org/ HTTP/1.0
  4. FTP request through the proxy server. The same as item 3, but with another protocol, for example:
    GET ftp://ftp.w3.org/ HTTP/1.0

What types of HTTP requests are not analyzed?

It is not possible to analyze HTTPS (or secure HTTP) because this protocol uses an encryption.

See also:

  • Host Header Logging into plaintext file
  • Host Header Logging into database


TrafMeter :: Host Header Logging into the plaintext file

Host Header Logging into the plaintext file

This feature is the simplest way to track HTTP requests which packets match at least one rule listed in the filter. To use Host Header Logging into the plaintext file, you should specify a Filename template for the logfiles. Every filter must have a unique Filename Template because it has own independent Host Header Collector.

Each line of the logfile contains information about one captured HTTP Request, for example:

2003-11-26 18:39:13   4 11 1  GET www.w3.org 192.168.4.5:1410 216.16.16.105:80 1218 24609
2003-11-26 18:39:19   4 11 1  GET www.w3.org 192.168.4.5:1411 216.16.16.105:80 748 12006
2003-11-26 18:39:31   4 11 1  GET www.w3.org 192.168.4.5:1412 216.16.16.105:80 718 12060

Where:

Column | Description
1 | Date when this record appeared in the logfile
2 | Time when this record appeared in the logfile
3 | Filter Id
4 | Type of the HTTP request
5 | Exit code of the HTTP request
6 | Method of the HTTP request
7 | Host name
8 | IP address and TCP port number of a client
9 | IP address and TCP port number of a server
10 | Number of bytes transferred from the client to the server
11 | Number of bytes transferred from the server to the client


TrafMeter :: Host Header Logging into the database

Host Header Logging into the database

Host Header Logging into the database provides a powerful technique to store and to analyze the HTTP requests, which packets match at least one rule listed in the filter. To use this feature you should specify:

  • Database Connection String
  • The name of Database Table for Host Header Logging

Note

  • You should manually create the database table before TrafMeter records the hosts.

See also:

  • A set of fields for the table to record the captured hosts


TrafMeter :: Database Table for Host Header Logging

Database Table for Host Header Logging

You must manually create the table in the database before TrafMeter records the hosts. A minimal set of the fields for the table is:

N | Name | Type | Description
1. | rtime | datetime | Time when this HTTP request was completed
2. | filterid | smallint | Filter Id
3. | rtype | smallint | Type of the HTTP request
4. | method | smallint | Method of the HTTP request
5. | reason | smallint | Exit code of the HTTP request
6. | clt_ip | char(16) | IP address of a client (in decimal-dotted notation, e.g. 192.168.3.250)
7. | clt_port | int | TCP port number of the client (the range is 0-65535)
8. | srv_ip | char(16) | IP address of a server (in decimal-dotted notation, e.g. 192.168.3.1)
9. | srv_port | int | TCP port number of the server (the range is 0-65535)
10. | clt_bytes | int | Number of bytes transferred from the client to the server
11. | srv_bytes | int | Number of bytes transferred from the server to the client
12. | host | char(250) | Host name

See also:

  • Microsoft SQL Server Syntax to create the table for Host Header Logging
  • MySQL Syntax to create the table for Host Header Logging
  • Microsoft Access Syntax to create the table for Host Header Logging


TrafMeter :: Microsoft SQL Server Syntax to create the table for Host Header Logging

Microsoft SQL Server Syntax to create the table for Host Header Logging

To create the table for Packet Logging with a minimal set of fields:

CREATE TABLE [dbo].[hosts] (
   ts datetime DEFAULT CURRENT_TIMESTAMP NOT NULL,
   rtime datetime,
   filterid smallint NOT NULL,
   rtype smallint,
   method smallint,
   reason smallint,
   clt_ip char(16),
   clt_port int,
   srv_ip char(16),
   srv_port int,
   clt_bytes bigint,
   srv_bytes bigint,
   host char(250))

Note

  • Field "ts" points to a time when the record was created. Microsoft SQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use CURRENT_TIMESTAMP function for this purpose as the default value for the field "ts".


TrafMeter :: MySQL Server Syntax to create the table for Host Header Logging

MySQL Server Syntax to create the table for Host Header Logging

To create the table for Packet Logging with a minimal set of fields:

create table hosts (
   ts timestamp,
   rtime datetime,
   filterid smallint  NOT NULL,
   rtype smallint,
   method smallint,
   reason smallint,
   clt_ip char(16),
   clt_port smallint unsigned,
   srv_ip char(16),
   srv_port smallint unsigned,
   clt_bytes int unsigned,
   srv_bytes int unsigned,
   host char(250));

Note

  • Field "ts" points to a time when the record was created. Microsoft SQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use the field with "timestamp" type.


TrafMeter :: Microsoft Access Syntax to create the table for Host Header Logging

Microsoft Access Syntax to create the table for Host Header Logging

Note

  • Field "ts" points to a time when the record was created. Microsoft Access must automatically insert the current date and time in the table with new record. Therefore, you should use the field with Now() function as the default value for the field "ts".


TrafMeter :: Result codes for Host Header Logging

Result codes for Host Header Logging

Type of the HTTP request

Code | Description
10 | HTTP/1.0
11 | HTTP/1.1
20 | HTTP request through the proxy server
20 | FTP request through the proxy server

Method of the HTTP request

Code | Description
1 | GET
2 | POST
3 | HEAD
4 | OPTIONS
5 | PUT
6 | DELETE
7 | TRACE

Exit code of the HTTP request

Code | Description
1 | TCP connection ended with FIN packets exchanging
2 | TCP connection ended with RST packets exchanging
3 | According HTTP/1.1 specification, it is possible to send several HTTP requests through single TCP connection (so called HTTP Keep-Alive requests). This exit code means that the first packet of the next HTTP request was transferred from a client side by using the same TCP connection.
4 | Timeout occured in TCP connection (by default, 600 seconds)
5 | Capturing the traffic was stopped and uncompleted HTTP requests were logged without waiting for the last packet of the TCP connection.


TrafMeter :: VPN

Counting VPN packets

There are two ways of counting VPN packets using TrafMeter. See table below:

 | Capturing from NDISWAN interface | Capturing from Ethernet interface
Capturing in promiscuous mode | No (can be counted only the packets with source or destination of your PC) | Yes (can be counted the packets with any source or destination)
Counting encrypted VPN packets | Yes | No
Type of VPN packets | Any | only which use GRE (number 47) as a transport protocol

Capturing from NDISWAN interface

This is the simplest way of counting VPN packets. Just select RAS (NDISWANIP) interface for capturing the packets and TrafMeter will receive "clear" IP packets from your VPN connection(s).

Capturing from Ethernet interface

TrafMeter can analyze captured VPN packets from an Ethernet interface and count useful information from inside the VPN packet as though it was a regular IP packet. TrafMeter parses VPN packets, which use GRE (number 47) as a transport protocol. PPP packets (number 0x880B) should be included inside the GRE packets, and also should carry IP packets with any necessary information. VPN packets can be compressed using algorithm MPPC (RFC 2118) but cannot be encrypted.

You should capture VPN packets from any Ethernet interface used for sending/receiving VPN packets. In the this case, TrafMeter will remove any payload from VPN packet to obtain encapsulated IP packet.

By default, VPN packet analysis is not enabled, but may be enabled in a specific filter by checking the corresponding option in the Filter Editor on the tab "Misc".

VPN packet rules are created exactly as regular IP packet rules because TrafMeter extracts the IP packet from a VPN packet.

Is my VPN connection encrypted?

Open status window of VPN connection:

Status windows without encryption | Status window with encryption


TrafMeter :: Service Registry

Registry Settings for TrafMeter Service

All settings of TrafMeter Service (except Filterset) are stored in the registry path:

[HKLM\Software\TrafMeter Software\TrafAgent\Settings]

There are several parameters of TrafMeter Service, which can be changed only by modifying the registry manually:

  • DeniedPktLogLevel (type REG_DWORD). It defines a level of logging the denied packets:
    0 - disables logging the denied packets:
    1 - enables logging the denied packets:
    2 - the same as 1 but includes MAC addresses
  • TrafficLimitMBytes (type REG_DWORD). It defines a number of bytes in 1 megabyte when checking a condition of the rule. It is used for creating traffic limits (for example, 1000000 will define 1 MB = 1000000 bytes). By default, 1 MB = 1048576 bytes.
  • LogMemUsage (type REG_SZ). It defines a full path of a file for logging a memory usage of TrafMeter Service. It is useful for detecting memory leaks in TrafMeter Service. By default, Logging the memory usage is disabled.
  • MSSQLConvertDateTime (type REG_DWORD) - It enables using function CONVERT() for converting type 'datetime' while recording Host Headers in MS SQL database:
    0 - disables using CONVERT() (by default)
    1 - enables using CONVERT(). Use this options when format of datetime is not 'yyyy-mm-dd hh:mi:ss'.
  • BindAddr (type REG_SZ). It defines IP address (in decimal-dot notation) which will be used for accepting incoming connections from TrafMeter Administrative Console. This address must belong to PC running TrafMeter service.


TrafMeter :: FAQ

Q: What is the difference between TrafMeter Editions?

A: See table

Q: Is it possible to run TrafMeter and TrafMeter Lite simultaneously at the same PC?

A: No. Only one instance of the TrafMeter Service can be running at any time on one PC. But you can run several instances of TrafMeter Administrative Console for remote management TrafMeter Services from the same PC.

Q: I've got the message "Cannot allocate memory for new filter". What is it?

A: This means that you are using TrafMeter Freeware Edition and you've exceeded the maximum number of free filters. To remove this restriction, you should purchase a license.

Q: Should I use different versions of TrafMeter Administrative Console for managment TrafMeter Service and TrafMeter Lite Service?

A: No. TrafMeter Administrative Console works with any editions of TrafMeter Service.

Q: How to restart TrafMeter Service using command line?

A: If you run TrafMeter Service as a Windows NT Service, you can use the commands:

  • net stop trafsvc will stop TrafMeter Service
  • net start trafsvc will start TrafMeter Service

Q: I've lost a password for TrafMeter Service. What should I do?

A: Remove the registry key [HKLM\Software\TrafMeter Software\TrafAgent\Settings\Password] and restart TrafMeter Service. After that, the password will be blank.

Q: I've specified a wrong IP address for accepting incoming connection of TrafMeter Service (dialogbox "Options", tab "Administration"). As result, I can't connect to TrafMeter Service on any address using TrafMeter Administrative Console (got "Error code = 10057"). What should I do?

A: This is a security feature of TrafMeter and you should use it when you exactly know what you are doing. To reset listen address, remove the registry key [HKLM\Software\TrafMeter Software\TrafAgent\Settings\BindAddr] and restart TrafMeter Service. After that, you may connect to TrafMeter Service without problem.

Q: Is it safe to manage TrafMeter Service over network? Can someone sniff my password for TrafMeter Service?

A: Remote administration is absolutely safe. TrafMeter uses one-time passwords for administration. So, sniffing the network packets for TrafMeter plaintext password is useless.

Q: What personal firewall do you recommend to use together with TrafMeter?

A: There is a built-in firewall coming with Service Pack 2 for Microsoft Windows XP.

Q: After installing TrafMeter on PC with ZoneAlarm, I see blocking all network activity via one of network interfaces. What's wrong?

A: Unfortunately, ZoneAlarm uses nonsafe NDIS hook that conflicts with TrafMeter's driver. We can't resolve this problem.

Q: TrafMeter doesn't detect my network adapters. What should I do?

A: First, reboot your PC. This really helps in 33% cases. Second, send us the file "support.txt" from TrafMeter's startup folder (by default, "c:\program files\TrafMeter\support.txt").

Q: I'm logging captured HTTP host headers and packets in Microsoft Access database. First, all worked fine. Suddenly logging errors have appeared. What's wrong?

A: Probably, you have exceeded a limit for size of Microsoft Access database. Check for http://support.microsoft.com/default.aspx?scid=kb;en-us;302524&Product=acc2003


TrafMeter :: FAQ2

Traffic counting with TrafMeter FAQ

Q: I installed TrafMeter on NAT router to do the Internet traffic accounting of users from my office network. I created the filter with the rule "A specific IP address - IP addresses of WAN" with "Both direction" flag enabled. I filled out the LAT, selected for capturing the network adapter. After starting the capture, I noticed that sent bytes counter doesn't work although received bytes counter works perfect. How to resolve this problem?

A: You should use Active Capture Mode for capturing the traffic on NAT routers.

Q: What is the technique of calculating the length of an IP packet in TrafMeter?

A: Every IP packet has a field in the header named "Total length". It contains the number of bytes in the entire packet, including the header. TrafMeter uses only the value obtained in this field to calculate the length of IP packet.

Q: I have created a filter with the rule from "Any address" to "Any address" with a mirrored flag enabled. The "sent bytes" cell displays a number that is very closely to the captured traffic but the "received bytes" cell shows zero. Incoming traffic isn't counted. What's wrong?

A: You can't split the traffic (sent & received) in the rule "from Any to Any". Imagine that you stand at the side of a two-way road and you see car traffic. What cars are incoming and what cars are outgoing? You can't answer because you need to get a reference point. Let's decide, the cars to the city "A" are inbound traffic and the cars to the city "B" are outgoing traffic.

Q: I have created a filter with the rule from "My computer" to "Any address" which only takes the ICMP packets into account. If I ping any host in my LAN, the counters will be increased normally. When I try to ping a nonexistent host in LAN, the counters will not be updated. What is wrong?

If you try to ping any host in LAN, ARP-request will be sent first to obtain a MAC address of pinged host. If your computer doesn't receive the ARP-response (because the pinged host doesn't exist), the ICMP packets will not be sent. Therefore, the counters of the ICMP filter will not be updated.

Q: I have a connection to Internet via a DSL modem plugged into an Ethernet hub and want to monitor traffic between my PC and the Internet. My PC has the IP address 192.168.1.2 and DSL modem has the IP address 192.168.1.1. I have created a TrafMeter filter with a rule "192.168.1.2 as source address" and "192.168.1.1 as destination address". I start capturing the traffic but all counters show zero. What's wrong?

A: You measure the traffic between your PC and your DSL modem. This is your mistake. Packets transmitted from your PC to the Internet don't have the IP address of your DSL modem as the destination. First, fill in a Local Address Table (LAT) with all addresses of your network (e.g., from 192.168.1.1 to 192.168.1.255). Second, create the filter with the rule "192.168.1.2 as source address" and "IP addresses of WAN as destination address".

Q: I use TrafMeter on my Internet gateway running web-caching proxy server SquidNT. All clients from my office network use proxy. TrafMeter counts successfully the traffic between clients and proxy server port but I want to not count the traffic of requests serving from cache. What should I do?

A: Unfortunately, you can't do that. TrafMeter reads raw network packets. These packets don't contain information whether that request was served directly or from cache.

Q: How to measure FTP traffic ?

A: This is a good introduction of FTP protocol obtained from www.deerfield.com. FTP is an acronym that stands for "File Transfer Protocol". FTP is used for transferring files over the Internet. There are 2 types of FTP connections, Active FTP and Passive FTP. The rules that you will require to count FTP are dependant on which mode of FTP you are using. The default behavior for most browsers is to use Passive FTP, while for most FTP Client programs (i.e. CuteFTP, Internet Neighborhood, WS-FTP) it is Active.

FTP consists of 2 unique connections between the client machine and the FTP server. One is called the "control" connection. This handles the user connecting to and logging into the FTP server. Once the user is logged in, the "data" connection is established to permit the listing of files in a directory, and allow for files to be uploaded or downloaded.

The "control" connection is the same for both Passive and Active FTP. The client makes the initial TCP connection from their temporary range of ports (i.e. any available port higher than 1023) to the server’s port 21 and says "Hi! I want to connect with you. Here is my user name and password". What happens next depends on whether Active or Passive mode is being used.

In Active mode, when the client says "Hi!" and logs in, they also tell the server a port number (again, somewhere in the temporary range) to use to connect back to them on to make the data connection. The FTP server logs the user in and then connects back to them from the server’s port 20 to the port that was given to open the data connection.

In Passive mode, after the client says "Hi!" and logs in, the FTP server logs them in, then tells the client what port to connect to the server on to make the data connection (this will be a port in the temporary range, 1024+). The client receives that information, then connects back from a temporary port to the FTP server on the port they were instructed to use, to open the data connection.

The major difference between Active and Passive mode FTP is which side is opening the data connection. In Active mode, the client machine needs to accept a data connection originating from the FTP server. In Passive mode, the client machine is always the one originating the connection.

Active Mode Example:
[1] Control Connection: Client port 1026 -> Server port 21
[2] Data Connection: Client port 1027 <- Server port 20

Passive Mode Example:
[1] Control Connection: Client port 1026 -> Server port 21
[2] Data Connection: Client port 1027 -> Server port 2065

We hope, that this information will help to create rules to count FTP traffic.


TrafMeter :: Example 1

Example 1

Goal
Monitoring the outgoing and incoming traffic of my computer.

Solution
Let's create a filter to count both the outgoing and incoming traffic. This filter will consist of only one rule.

Filter 1. Traffic from My computer to any host.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | My computer |  | Any |  | Yes | Count |

Note

  • This filter is the simplest way to check TrafMeter for the traffic capture
  • An error will occur, if you use "My Computer" as the source address and "My Computer" as the destination address simultaneously
  • An error will occur, if you use "Any IP address" as the source address and "My computer" as the destination address simultaneously


TrafMeter :: Example 2

Example 2

Goal
Monitoring the outgoing and incoming traffic of my computer and traffic monitoring to host 192.168.2.2.

Solution
It is required to create two filters. The first filter will count the traffic from my computer to host 192.168.2.2. The second filter will count all traffic of my computer except the traffic to host 192.168.2.2.

Filter 1. Traffic from my computer to host 192.168.2.2.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | My computer |  | 192.168.2.2 |  | Yes | Count and pass |
Filter 2. All traffic of my computer except host 192.168.2.2.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | My computer |  | Any |  | Yes | Count |

This filterset can be explained as follows. Captured packets, matching the first filter will be counted and will not be processed by the second filter because the single rule of the first filter has the action "Count and Pass". Therefore, all captured packets, except for the ones matching the first filter, will be processed by the second filter.


TrafMeter :: Example 3

Example 3

Goal
To count WWW traffic from a specific IP address (e.g., 192.168.0.1) to any webserver.

Solution
Let's create a single filter with two rules. The first rule will count the regular (non-secure) WWW traffic and the second rule will count the secure WWW traffic.

Filter 1. WWW traffic from the specific host 192.168.0.1 to any webserver
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | 192.168.0.1 | Any | Any | 80 | Yes | Count |
2 | TCP | 192.168.0.1 | Any | Any | 443 | Yes | Count |

Note

  • To simplify the solution, we assume that WWW traffic uses only TCP ports 80 and 443. However, you should keep in mind that the webserver can listen for incoming WWW connection on any TCP port (e.g., TCP port 8080).


TrafMeter :: Example 4

Example 4

Goal
You are an administrator of your corporate Lotus Notes server (e.g., the server has the IP address 216.106.88.42). The server accepts incoming connections (Lotus Notes and SMTP) from the other servers and initiates the outgoing connection (Lotus Notes and SMTP). You want to monitor and count the Lotus Notes traffic and SMTP mail traffic. Let's assume that the Lotus Notes traffic uses TCP port 1352 and the SMTP protocol uses TCP port number 25.

Solution
You should create four filters.

Filter 1. The outgoing Lotus Notes connections.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | My computer | Any | Any | 1352 | Yes | Count |
Filter 2. The outgoing SMTP mail.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | My computer | Any | Any | 25 | Yes | Count |
Filter 3. The incoming Lotus Notes connections.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | My computer | 1352 | Any | Any | Yes | Count |
Filter 4. The incoming SMTP mail.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | My computer | 25 | Any | Any | Yes | Count |

Note

  • In this example, TrafMeter Service must be running on Lotus Notes server.


TrafMeter :: Example 5

Example 5

Goal
You are an administrator of your office network. Your PCs have IP addresses, ranging 192.168.3.2-192.168.3.255. The office network is connected to the Internet by a NAT router running Microsoft Windows Server 2003 (192.168.3.1). Your goal is to count the Internet-traffic for every PC of the office network. The traffic between the PCs within the office network must not be accounted.

Solution
You should do the following:
- Fill in the Local Address Table (LAT) with a range 192.168.3.1-192.168.3.255
- Create the filters for traffic accounting (one filter per PC)

Filter 1. Internet traffic of PC 192.168.3.2.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.3.2 |  | IP addresses of WAN |  | Yes | Count |
Filter 2. Internet traffic of PC 192.168.3.3.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.3.3 |  | IP addresses of WAN |  | Yes | Count |
Filter 3. Internet traffic of PC 192.168.3.4.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.3.4 |  | IP addresses of WAN |  | Yes | Count |
Filter 4. Internet traffic of PC 192.168.3.5...
Filter 5. Internet traffic of PC 192.168.3.6...

Note

  • In this example, you should not use the DHCP service to assign the IP addresses to the PCs.
  • In this example, TrafMeter Service can run on a NAT router or on any PC of the office network. See topic "TrafMeter Installation Guide" for details.
  • You should use Active Capture Mode on computers running NAT.


TrafMeter :: Example 6

Example 6 (the same as example 5 but with an additional condition)

Goal
You are an administrator of your office network. Your PCs have IP addresses, ranging 192.168.3.2-192.168.3.255. The office network is connected to the Internet by a NAT router running Microsoft Windows Server 2003 (192.168.3.1). Your goal is to count the Internet-traffic for every PC of the office network. The traffic between the PCs within the office network must not be accounted. You have an additional condition:

- to count the total Internet traffic of the whole office network
- to block the Internet access for a specific PC if this PC has reached the limit of 50mb of the Internet traffic

Solution
You should do the following:
- Install TrafMeter Service on a PC running a NAT router
- Choose two network adapters for the traffic capture in TrafMeter (the network adapter connected to the office network and the network adapter connected to your ISP)
- Select Active Capture Mode in TrafMeter
- Fill in the Local Address Table (LAT) with a range 192.168.3.1-192.168.3.255
- Create the filters for the traffic accounting (one filter per PC)

Note

  • In this example, the traffic will be captured from 2 network adapters simultaneously. Therefore, you should avoid counting the same packet twice. To do this, the Internet traffic of the network adapter, connected to ISP will be counted using a MAC address. Let's assume that the MAC address of that adapter is 010203040506.
Filter 1. The total Internet traffic of whole office network
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | MAC: 010203040506 |  | IP addresses of WAN |  | Yes | Count and Pass |
Filter 2. Internet traffic of PC 192.168.3.2.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.3.2 |  | IP addresses of WAN |  | Yes | Deny | When sent or recv counter is greater than 50mb
2 | Any | 192.168.3.2 |  | IP addresses of WAN |  | Yes | Count |
Filter 3. Internet traffic of PC 192.168.3.3.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.3.3 |  | IP addresses of WAN |  | Yes | Deny | When sent or recv counter is greater than 50mb
2 | Any | 192.168.3.3 |  | IP addresses of WAN |  | Yes | Count |
Filter 4. Internet traffic of PC 192.168.3.4...
Filter 5. Internet traffic of PC 192.168.3.5...

Note

  • The traffic counters can be dropped to zero using TrafMeter Administrative Console or using the command line utility TrafReset.exe included in the TrafMeter package. You can schedule a launching TrafReset.exe by Windows Scheduler to obtain the daily/weekly/monthly traffic limits.
  • In this example, you should not use the DHCP service to assign the IP addresses to the PCs.
  • In this example, TrafMeter Service must run only on a NAT router.


TrafMeter :: Example 7

Example 7

Goal
You are an administrator of your office network. Your PCs have IP addresses, ranging 192.168.3.2-192.168.3.255. The office network is connected to the Internet by a gateway running Microsoft Windows Server 2003 with NAT (192.168.3.1). The gateway runs also proxy server that serves connections from browsers. The proxy server accepts incoming connections on TCP port 3128. Other Internet traffic (e.g. SMTP, POP3 and etc) comes out using NAT. Your goal is to count the Internet-traffic for every PC of the office network. The traffic between the PCs within the office network must not be accounted.

Solution
You should do the following:
- Fill in the Local Address Table (LAT) with a range 192.168.3.1-192.168.3.255
- Create the filters for traffic accounting (one filter per PC). Every filter should contain two rules (the rule for proxy traffic and for NAT traffic).

Filter 1. Internet traffic of PC 192.168.3.2.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | 192.168.3.2 | Any | 192.168.3.1 | 3128 | Yes | Count |
2 | Any | 192.168.3.2 |  | IP addresses of WAN |  | Yes | Count |
Filter 2. Internet traffic of PC 192.168.3.3.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | 192.168.3.3 | Any | 192.168.3.1 | 3128 | Yes | Count |
2 | Any | 192.168.3.3 |  | IP addresses of WAN |  | Yes | Count |
Filter 3. Internet traffic of PC 192.168.3.4.
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | TCP | 192.168.3.4 | Any | 192.168.3.1 | 3128 | Yes | Count |
2 | Any | 192.168.3.4 |  | IP addresses of WAN |  | Yes | Count |
Filter 4. Internet traffic of PC 192.168.3.5...
Filter 5. Internet traffic of PC 192.168.3.6...

Note

  • In this example, you should not use the DHCP service to assign the IP addresses to the PCs.
  • In this example, TrafMeter Service can run on a NAT router or on any PC of the office network. See topic "TrafMeter Installation Guide" for details.
  • See FAQ question
  • You should use Active Capture Mode on computers running NAT.


TrafMeter :: Example 8

Example 8

Goal
You are an administrator of a large Internet Service Provider (ISP). Your ISP has 10Mbit Internet Connection, about 200 users (say, they have IP addresses 192.168.0.0/24) and 5000-10000 active sessions. You want to record all packets transmitted between the Internet and the users. What is the best solution?

Solution
For this scenario, it will not be effective to use the strategy "one filter per one user" due to the complexity of managing the filterset with 200 filters. The simplest way is to create filter "Your users - WAN" and enable Packet Logging:

Filter 1. The total Internet traffic of the users
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.0.0/24 |  | IP addresses of WAN |  | Yes | Count |

Note

  • To use the rule with "IP addresses of WAN", you should fill in the Local Address Table (LAT)

Because Packet Collector has a size of 2000 positions, there is a probability that you'll get an overflow of Packet Collector for such filter. It means that not of all the captured packets will be recorded. To avoid this problem, you can decrease the frequency of Packet Collector flushing down to 10 seconds or apply a load balancing for Packet Collector. The idea of the load balancing is a logical dividing (not a physical dividing) of your network into several subnets and performing the recording of the captured packets for every subnet:

Filter 1. The total Internet traffic of the users 192.168.0.0/26
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
1 | Any | 192.168.0.0/26 |  | IP addresses of WAN |  | Yes | Count |
Filter 2. The total Internet traffic of the users 192.168.0.64/26
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
2 | Any | 192.168.0.64/26 |  | IP addresses of WAN |  | Yes | Count |
Filter 3. The total Internet traffic of the users 192.168.0.128/26
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
3 | Any | 192.168.0.128/26 |  | IP addresses of WAN |  | Yes | Count |
Filter 4. The total Internet traffic of the users 192.168.0.192/26
N Rule | Type of IP protocol | Source address | Source port | Destination address | Destination port | Both directions | Action for packet | Additional condition
4 | Any | 192.168.0.192/26 |  | IP addresses of WAN |  | Yes | Count |

If you get a message "Packet Collector is full" for any filter with a network mask /26, you should consider dividing your network into more small subnets (for example, use a network mask /28).

Is it possible to create Packet Collector with an unlimited size?

Yes. But this will be not effective. To put the captured packet into Packet Collector, the proper position for the new packet must be found in Packet Collector. If Packet Collector is unlimited size, the searching will take many CPU cycles.


TrafMeter :: IP protocol number

IP protocol number

Q0001

IP protocol number is 1-byte field in IP protocol header. This value specifies the higher-level protocol contained in the packet data field. The table "Assignments for an IP Packet Protocol Field" lists some of the values that have been assigned to specific protocols or organizations. Note that this list is subject to change. The Internet Assigned Numbers Authority (IANA) is the keeper of the protocol assignments. Official lists are published in the "Assigned Numbers" RFC 1700.

Assignments for an IP Packet Protocol Field
Value | Protocol
1 | ICMP
2 | IGMP
3 | GGP
6 | TCP
8 | EGP
17 | UDP
47 | GRE
50 | ESP
51 | AH
89 | OSPF
115 | L2TP


TrafMeter :: Q0002 :: Type Of Service (ToS) field

Type Of Service (ToS) field

Q0002

The ToS field (1 byte) is used IP protocol suite to describe the desired quality of service for an IP datagram by upper layer protocols like TCP. This field can be used to specify the nature and priority of a IP datagram (like Network Control, Immediate, Critical, etc) and the criteria for selecting a path for forwarding a datagram by a gateway. RFC 1349 discusses the Type Of Service (TOS) field.

Unless you exactly know what you do, don't create rules checking Tos field.


TrafMeter :: Q0003 :: MAC address

MAC address

Q0003

A MAC address, also know as a physical address or a hardware address, is a unique numerical value assigned to a network interface card (NIC) during the manufacturing process or by setting jumpers or switches during network installation. One part of this address is assigned to the manufacturer by the IEEE (Institute of Electronics Engineers) and is common to all components from that manufacturer; the second part of the hardware address is a unique value assigned by the hardware manufacturer.

For example, the physical address (or MAC address) of ethernet adapter can be 52-54-AB-20-88-AD. TrafMeter allows to create rules with MAC address as source or/and destination addresses.


TrafMeter :: Q0004 :: Promiscuous mode

Promiscuous mode

Q0004

In a Ethernet local area network (LAN), promiscuous mode is a mode of operation in which every data packet transmitted is received and read by every network adapter. Promiscuous mode must be supported by each network adapter as well as by the input/output driver in the host operating system. Promiscuous mode is often used to monitor network activity. Promiscuous mode is the opposite of non-promiscuous mode. When a data packet is transmitted in non-promiscuous mode, all the LAN devices "hear" the data to determine if the network address included in the data packet is theirs. If it isn't, the data packet is passed onto the next LAN device until the device with the correct network address is reached. That device then receives and reads the data.


TrafMeter :: Q0005 :: Ethernet hub

Ethernet hub

Q0005

The Ethernet hub is an item of network equipment that allows multiple devices to communicate on the same Ethernet. Hubs are fairly simple devices, consisting of several ports to which network devices can be connected, and sometimes an additional port to which another hub can be connected.

The Ethernet hub is used as a central connection point for a small network. All workstations, printers and routers or modems on the network will be connected at the hub. This is referred to as a ‘star wired’ network topology. The hub has a number of ports for connecting devices. Each device to be connected to the hub must be Ethernet ready, with either a built in Ethernet port or an Ethernet card. Printers have special cards called print servers. These can be either internal or external to the printer.

A 10BaseT or 100BaseT Ethernet hub (10 or 100 mbps over twisted pair cabling) does two things:

  1. Retimes and regenerates Ethernet signals received from other stations
  2. Relays Ethernet signals between stations

An Ethernet hub’s data capacity for ALL ports combined is limited to the bandwidth of the Ethernet type used. This means that on a 10BaseT network, if 8 devices are connected to a hub, all communication from these devices must share the 10mbps of bandwidth in the hub. This example shows one of the main limitations of a hub. If all 8 devices were transmitting the full 10mbps of data possible, the hub would be overwhelmed with 80mbps of traffic.


TrafMeter :: Q0006 :: Ethernet switch

Ethernet switch

Q0006

The Ethernet switch serves the same function as a hub, in that it is the center of a star wired network, but it handles traffic much differently. A switch has much more available bandwidth than a hub. On a switch, EACH PORT has its own exclusive allocation of bandwidth. A 12 port 100mbps switch, for example, has 1.2gbps of network bandwidth capacity (12 ports x 100mbps).

The Ethernet switch makes intelligent decisions about where a packet entering a port is supposed to go. As it known, Ethernet is a collision-based protocol. Switches essentially eliminate collisions on an Ethernet network, because the switch is aware of the MAC address of every device on the network. The switch is also capable of analyzing packets as they enter a port, and forwarding them based on the destination MAC address. Hubs are ‘dumb’-- they can’t make these routing decisions.


TrafMeter :: Q0007 :: Ethernet

What is Ethernet ?

Q0007

Ethernet works on a principle called "Carrier Sense Multiple Access / Collision Detect" or "CSMA/CD". "Multiple Access" refers to the way multiple computers access a single Ethernet segment. Originally, this meant a single coax segment. Now this refers to all stations on the same "side" of a network switch or bridge. "Carrier Sense" means that each station on an Ethernet segment can determine if any other station is transmitting. This way, if one station is transmitting, another won't begin. However, if two stations begin transmitting at roughly the same time, carrier sense will not prevent the two transmissions from interfering with each other. This is known as a collision. The "Collision Detect" feature of Ethernet will allow a station that is transmitting to detect when another station is also transmitting (and a collision has occurred), and it will then send a jamming signal to all stations on the Ethernet segment. When this signal is received, each station will cease transmission, and will begin a randomized countdown to determine when it can transmit again.


TrafMeter :: Q0008 :: NAT router

NAT router

Q0008

NAT router is PC or stand-alone device with two or more network interfaces.

NAT stands for Network Address Translation, providing transparent access to the rest of the IP network (usually Internet) via one gateway computer. The computers all have unique ip addresses, but the outside world only sees one address, the one of the server.

In Windows 2000, NAT router can be enabled on the tab "Sharing" in properties of a network connection or using the snap-in "Routing and Remote Access" (only for Windows 2000 Server).

In Windows XP, NAT router can be enabled on the tab "Advanced" in the properties of the network connection.

There are third-party NAT implentations for Microsoft Windows.


TrafMeter :: Q1000 :: HOWTO: Creating an OLE DB Connection String for Microsoft SQL Server

HOWTO: Creating an OLE DB Connection String for Microsoft SQL Server

Q1000

Before creating OLE DB Connection String, it is highly recommended to have existed Microsoft SQL database for TrafMeter.

  1. Start the UDL Wizard:
    • Right-click your desktop and select New, and then Text Document.
    • Rename the new text document as My.udl. Press ENTER.
    • You will receive a warning about renaming the file extension. Click yes. Note that the file's icon now looks like a computer with a datasheet in the background.
  2. Next, double-click My.udl and use the Wizard as follows:
    • Click the Provider tab.
    • From the Providers menu, select Microsoft OLE DB Provider for SQL Server, and then click Next to proceed to the Connections tab.
  3. On the Connections tab:
    • Type your server name or browse to the server you want to connect to.
    • Enter information to log on to the server
    • Select the database on the server
    • Click "Test Connection" to be sure that you've got no error
    • Click OK, which will close the Wizard.
  4. Move My.udl from the desktop to a proper folder, for example C:\Program Files\TrafMeter


TrafMeter :: Q1002 :: HOWTO: Creating an OLE DB Connection String for an Access 97/2000/XP Database

HOWTO: Creating an OLE DB Connection String for an Access 97/2000/XP Database

Q1002

Before creating OLE DB Connection String, it is highly recommended to have existed Microsoft Access database for TrafMeter.

Using the UDL Wizard to Create an OLE DB Connection String

  1. Start the UDL Wizard:
    • Right-click your desktop and select New, and then Text Document.
    • Rename the new text document as My.udl. Press ENTER.
    • You will receive a warning about renaming the file extension. Click yes. Note that the file's icon now looks like a computer with a datasheet in the background.
  2. Next, double-click My.udl and use the Wizard as follows:
    • Click the Provider tab.
    • From the Providers menu, select Microsoft Jet 4.0 OLE DB Provider, and then click Next to proceed to the Connections tab.
  3. On the Connections tab:
    • Type your database name or browse to the database you want to connect to.
    • Use the default settings for credentials (Admin, no password). (To use the default settings, enter Admin as the user name, and then select the Blank Password checkbox).
    • Click "Test Connection" to be sure that you've got no error
    • Click OK, which will close the Wizard.
  4. Move My.udl from the desktop to a proper folder, for example C:\Program Files\TrafMeter


TrafMeter :: Q1010 :: HOWTO: Creating an OLE DB Connection String for MySQL

HOWTO: Creating an OLE DB Connection String for MySQL

Q1010

Download from www.mysql.com and install MySQL ODBC Driver 3.51 or higher. Before creating OLE DB Connection String, it is highly recommended to have existed MySQL database for TrafMeter.

  1. Start the UDL Wizard:
    • Right-click your desktop and select New, and then Text Document.
    • Rename the new text document as My.udl. Press ENTER.
    • You will receive a warning about renaming the file extension. Click yes. Note that the file's icon now looks like a computer with a datasheet in the background.
  2. Next, double-click My.udl and use the Wizard as follows:
    • Click the Provider tab.
    • From the Providers menu, select Microsoft OLE DB Provider for ODBC drivers, and then click Next to proceed to the Connections tab.
  3. On the Connections tab:
    • Select "Use connection string" and click "Build..." button.
    • On a new dialog box, click "New..." button, then the window "Create New Data Source" will appear.
    • Select "MySQL ODBC 3.51 Driver" and click "Next" button
    • Type DSN name, for example "mysql_linux" and click "Next" button, then click "Finish" button in the next dialog box
    • Enter information about server name, database, user and password
    • Click "Test Data Source" to be sure that you've got no error
    • Click OK, which will close the Wizard.


TrafMeter :: Q2001 :: Manual editing of XML files

Manual editing of the XML files created by TrafMeter

Q2001

TrafMeter uses the XML format as a basic format for the configuration files and reports. Be careful while modifying XML files created by TrafMeter using a third-party tool, because TrafMeter saves its own documents in the UTF-8 encoding.

UTF-8 encodes each Unicode character as a variable number of 1 to 6 octets, where the number of octets depends on the integer value assigned to the Unicode character. It is an efficient encoding of Unicode documents that use US-ASCII characters because it represents each character in the range U+0000 through U+007F as a single octet.

Note

  • Don't use editors not supporting UTF-8 encoding (for example, ES-Computing Editplus, FAR Manager built-in editor and etc)
  • Use editors supporting UTF-8 encoding (for example, Altova XML Spy, Microsoft Visual Studio .NET and etc)

It is highly recommended to open the XML document after its modifying in Microsoft Internet Explorer for a check-up.


TrafMeter :: Q2003 :: TrafReset

Zeroing counters using the utility TrafReset

Q2003

The TrafMeter installation package contains the utility TrafReset, which performs the counter reset using a special communication protocol with the TrafMeter Service. If you run TrafReset without parameters on the command line, you will see the following:

TrafReset version 4.5
Usage: TrafReset hostname password filterid1 filterid2 filterid3 ..

So, all parameters are passed into TrafReset using the command line:

  • 1st parameter - address or DNS name of the host running the TrafMeter Service. You may specify the remote host as well.
  • 2nd parameter - password for the TrafMeter service. If you want to use TrafReset, the password in the TrafMeter Service cannot be blank.
  • 3rd (4th, 5th and etc) parameter(s) - Id of filters (FilterId) which will be zeroed out. You can specify an unlimited number of FilterId's on the command line. If you want to zero all counters, specify "ALL" instead FilterId.

Example:

TrafReset.exe localhost qwerty ALL

For the periodic running of TrafReset you should first create a .bat file that will invoke TrafReset with the necessary command line parameters (for example, trafficreset.bat). Secondly, add a scheduled task in the Task Scheduler, which will run the newly created .bat file.

How do I run TrafReset once per day when the user logs in?

See the example VB script "trafreset_once.vbs" in the TrafMeter installation package.

Note

  • "Zeroing counters" means resetting to zero only the current values of traffic counters, which you can see in the TrafMeter Administrative Console. This doesn't change any other traffic reports in XML files or in any database.


TrafMeter :: Q2006 :: Reloading the Filterset

Automatically reloading the Filterset by the TrafMeter Service

Q2006

Due to the fact that the main configuration of TrafMeter, or "Filterset", is stored in an XML file, an administrator can change this file manually or by using a third-party tool. To apply such changes "on the fly" without using the Administrative Console, you can create a zero-length file with the name "your_filterset.reload" in the Filterset folder. Assuming that "your_filterset" is the name of the currently loaded Filterset. For example, if the Filterset is loaded from the file "default.tmf", then the reload file would be named "default.reload". If the TrafMeter Service deletes the reload file successfully, the reload will be performed.

Note

  • By default, the Filtersets are stored in %programfiles%\TrafMeter\Filtersets.
  • If the TrafMeter Administative Console is connected to the TrafMeter Service during reloading, it will be disconnected without any notification.


TrafMeter :: XML Traffic Reports :: Monthly example

The example of Monthly XML Traffic Reports

<?xml version="1.0"?>
<TrafficReport>
    <Filter Id="15">
        <Name>POP3 traffic</Name>
        <Sent>2518192</Sent>
        <Recv>12315902</Recv>
        <Day dt="030822">
            <Sent>677994</Sent>
            <Recv>3510996</Recv>
        </Day>
        <Day dt="030823">
            <Sent>1229603</Sent>
            <Recv>7758167</Recv>
        </Day>
        <Day dt="030824">
            <Sent>610595</Sent>
            <Recv>1046739</Recv>
        </Day>
    </Filter>
</TrafficReport>