TrafMeter :: Welcome to TrafMeter

Welcome to TrafMeter

Your organization is connected to the Internet, but can you ensure that it is used appropriately and effectively? Do you want to monitor and count IP traffic between your local area network (LAN) and Internet? TrafMeter counts traffic in your LAN and shows it as colored lines in realtime. So you can always "see" which user is using the Internet connection most of all.

Make your IP traffic visible with TrafMeter!

TrafMeter main features

  • Numerical and graphical format of the readout
  • Counting of custom IP packets with a flexible filter engine
  • "Live" graphical representation of bandwidth usage in a real-time like a traffic monitor
  • Creating XML Traffic Reports
  • Writing counters in a database
  • Packet Logging in a file or in the database for further analysis
  • Requires no special hardware or configuration
  • Running as a normal application or as a Windows 2000/XP service
  • Simple, easy to understand an user interface

TrafMeter site: http://www.lastbit.com/trafmeter


TrafMeter :: Licence agreement

TRAFMETER LICENSE AGREEMENT

This End-User License Agreement ("EULA") is a legal agreement between you, either an individual or a single entity, ("LICENSEE") and LastBit Software ("LICENSOR").

The license agreement includes computer software and may include associated media and online or electronic documentation ("SOFTWARE PRODUCT"). Please read the following terms and conditions before installing the SOFTWARE PRODUCT. By installing or using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. If you do not agree to the terms of this EULA, do not install or use the SOFTWARE PRODUCT.

Copyright laws and international copyright treaties, as well as other intellectual property laws and treaties protect the SOFTWARE PRODUCT.

The SOFTWARE PRODUCT is licensed, not sold.

GRANT OF LICENSE
This EULA grants you the following rights:

USE AND COPY
You may install SOFTWARE PRODUCT on no more than one machine per valid license or as defined by purchased licenses. You may make other copies of the SOFTWARE PRODUCT for backup and archival purposes.

LICENSE TYPES
SOFTWARE PRODUCT is licensed on a RUN-TIME basis, which means, that for each machine on which SOFTWARE PRODUCT is installed, a valid run-time license must exist. Software licenses are provided as unique registration codes and/or serial numbers used to remove time-out settings in the software.

Single License
Allows installation and execution of SOFTWARE PRODUCT on a single machine per license.

Site License
Allows installation and execution of SOFTWARE PRODUCT on multiple machines within a single physical location (i.e. an office or data center location at a single physical address)

Enterprise License
Allows installation and execution of SOFTWARE PRODUCT on multiple machines in multiple locations throughout the licensed company's facilities.

RESTRICTIONS
Unregistered versions (shareware licensed copies) of the SOFTWARE PRODUCT may be used for a period of not more than 30 days. After 30 days, you must either stop using the SOFTWARE PRODUCT, or purchase a validly licensed copy or purchase a legal registration key / serial number.

You must maintain all copyright notices on all copies of the SOFTWARE PRODUCT.

You may not sell copies of the SOFTWARE PRODUCT to third parties without express written consent of THE LICENSOR and under THE LICENSOR's instruction.

EVALUATION copies may distributed freely without charge so long as the SOFTWARE PRODUCT remains whole including but not limited to existing copyright notices, installation and setup utilities, help files, licensing agreement, run-time libraries, etc. and DOES NOT CONTAIN either valid serial numbers or illegal serial numbers. In executing such an act, or similar copyright or license violation, to the maximum extent permitted by applicable law you may be held liable for loss of revenue to THE LICENSOR or THE LICENSOR's representatives due to loss of sales or devaluation of the SOFTWARE PRODUCT or both.

You may not rent, lease, lend, copy, modify, sub-license or time-share the SOFTWARE PRODUCT. You may not reverse engineer, decompile or disassemble or otherwise alter the SOFTWARE PRODUCT or its documentation. You may not use a Registration Key Code issued to another user for use in conjunction with the SOFTWARE PRODUCT.

You may permanently transfer all of your rights under this EULA only in conjunction with a permanent transfer of your validly licensed copy of the product(s).

You must comply with all applicable laws regarding the use of the SOFTWARE PRODUCT.

You may not execute this software on more than ONE machine per valid license except as outlined under GRANT OF LICENSE - use and copy.

TERMINATION
THE LICENSOR may terminate this EULA if you fail to comply with the terms and conditions of this EULA. In such event, you must destroy all copies of the SOFTWARE PRODUCT.

COPYRIGHT.
All title and copyrights and intellectual property rights in and to the SOFTWARE PRODUCT and any copies thereof are owned by THE LICENSOR.

NO WARRANTY
ANY USE OF THE SOFTWARE PRODUCT IS AT YOUR OWN RISK. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE AUTHOR DISCLAIMS ALL WARRANTIES AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.

NO LIABILITY FOR CONSEQUENTIAL DAMAGES.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF, MIS-USE OF OR INABILITY TO USE THE SOFTWARE PRODUCT, EVEN IF THE AUTHOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

LIMITATION OF LIABILITY.
THE AUTHOR'S ENTIRE LIABILITY AND YOUR EXCLUSIVE REMEDY UNDER THIS EULA SHALL NOT EXCEED ONE DOLLAR (US$1.00).


TrafMeter :: Quick start

Quick Start Guide

This is a step-by-step Guide how to begin a work in TrafMeter. You should be familiar with TCP/IP technologies to create rules for a traffic counting. However, to better understand a conception of TrafMeter we provide this Guide. Assume that our goal is to monitor traffic from your PC to your proxy-server 192.168.190.11.

  1. Install WinPcap driver and reboot your PC. Start TrafMeter and select a network adapter (in other words, select a captured device for IP packets):
  2. Invoke a Filter Manager by clicking [image] button on the toolbar
  3. In the Filter Manager click on a button Add filter... to create a new filter
  4. The Filter Editor will be invoked. Click on a button Add rule... to create a counting rule in the filter
  5. In the Rule Editor select My computer in the Source address combobox and A specific IP address in the Destination address combobox. Type IP address of your proxy server (e.g., 192.168.190.11) and click on OK button
  6. Make sure that the new rule has been appeared in the list of rules in the Filter Editor. Click on OK button to return to the Filter Manager
  7. Click on the Start button and make some traffic from your PC to target server (192.168.190.11)


TrafMeter :: How To Contact Us

How To Contact Us

If you have any comments, suggestions, or bug reports with regard to TrafMeter, please fill out the online feedback form at http://www.lastbit.com/feedback.asp or send us an e-mail trafmeter@lastbit.com

If your question is about technical support, please attach in your message the file "adapters_TrafMeter.txt" and the file "applog.txt" from the TrafMeter's startup folder (e.g. c:\Program Files\TrafMeter\adapters_TrafMeter.txt and c:\Program Files\TrafMeter\applog.txt). Any additional information about your network environment will be useful as well. It may speed up to produce an answer on your question.

Postal address:
LastBit Software
1133 Broadway, Suite 706
New York, NY 10010

Telefon/fax (877)684-2996


TrafMeter :: Registration info

How to order TrafMeter

After you download and install TrafMeter, you have 30 days to try the product. You will be reminded about the need to register after each TrafMeter's start. TrafMeter will not run after its evaluation period has expired if not registered.

For fastest delivery please order online using your creditcard. To do so, please choose an ORDER link below. Your software will usually be delivered within 1-2 days! We also offer the following alternatives to order your license:

  • Order online and pay by bank/wire transfer, check or cash: Please click an ORDER-link below, click "Proceed to Checkout" and follow the instructions.

  • Order by fax/phone: Please click an ORDER-link below, click "Proceed to Checkout" and click the link "order by fax" near the bottom of the page and follow the instructions.

  • Order by phone. In this case you don't need to fill the registration form. The numbers: +1-800-903-4152 (USA toll free number) or +49-221-3108820 (Germany). You'll be asked for the program number (refer to the Item ID in the table below).

Orders are processed by Element 5 AG www.shareit.com

As a registered user you will be able to receive TrafMeter updates for FREE in the first year.

Single license Allows installation and execution of TrafMeter on a single machine per license. | $49 | ORDER item 146869
Site license Allows installation and execution of TrafMeter on multiple machines within a single physical location (i.e. an office or data center location at a single physical address) | $295 | ORDER item 163174
Enterprise license Allows installation and execution of TrafMeter on multiple machines in multiple locations throughout the licensed company's facilities. | $695 | ORDER item 163175


TrafMeter :: Minimum System Requirements

Minimum System Requirements

  • Pentium processor-based IBM PC compatible computer *
  • 32 MB of memory
  • Microsoft Windows 95/98/ME/NT/2000/XP
  • Microsoft Internet Explorer 5.0 **
  • About 2 MB of free disk space
  • A mouse
  • Free Windows Packet Capture Driver (WinPcap) developed by the Politecnico di Torino, and its contributors. Copyright (c) 1999, 2000, Politecnico di Torino. All rights reserved. The latest version of WinPcap can be downloaded from
    http://winpcap.polito.it/install/bin/WinPcap_2_3.exe
  • * Due to limitation of WinPcap driver, TrafMeter can't run on multi-processors systems.
  • ** More powerful Microsoft Internet Explorer is an advantage

"This product includes software (Windows Packet Capture Driver) developed by the Politecnico di Torino, and its contributors.''


TrafMeter :: Architecture

click to enlarge

How does TrafMeter capture the packets from network ?

TrafMeter uses the free WinPcap driver as the packet capture engine. WinPcap includes a kernel-level packet filter, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (wpcap.dll). The packet filter is a device driver that adds to Windows 95, 98, ME, NT, 2000 and XP the ability to capture and send raw data from a network card, with the possibility to filter and store in a buffer the captured packets.

The Filterset

The filterset is a main unit of TrafMeter. It consists of the preliminary filter, the filters to count custom IP packets, settings for making reports of a traffic usage and settings for a drawing of a graphic chart. The filterset can be saved in a file and loaded after TrafMeter startup. Due to the filterset isn't bound to a specific network adapter, you can share the filterset between computers in your network.

The Filters to count the traffic

Every filter contains own rule subset (up to 50 rules) making possible to count only useful traffic. In additional, it has an independent traffic collector, 64-bit sent bytes counter and 64-bit received bytes counter. The traffic counters will be updated if captured packet satisfies at least one rule listed in the filter. The number of the filters in TrafMeter is unlimited however a very more filters (>200) can decrease a system performance and can complicate a filters management.

The Preliminary Filter

The Preliminary Filter can block packets before they will be passed through all TrafMeter filters. It can be used to prevent a counting of useless traffic and to simplify a creating of rules in the filters. The Preliminary Filter has no counters. The Preliminary Filter is very effective when the total number of rules in all filters is more than the total number of rules in the Preliminary Filter.


TrafMeter :: TrafMeter installation Guide

TrafMeter Installation Guide

This Guide will help you to determine the optimum location for TrafMeter in order to count traffic between your computer network and Internet.

Simple network configuration

In a small- or medium-sized organization, the computer network may consist of only one Ethernet segment to which all workstation computers are connected, often by means of a network Ethernet hub. Ethernet segment may be connected to the Internet by an access router/gateway/firewall device, as shown in Figure 1.

For simple network configurations, install TrafMeter on a computer connected to Ethernet hub carrying all traffic to and from the Internet gateway and enable promiscuous mode on the network adapter.

If gateway is Windows-based computer with proxy-server software (e.g. Microsoft ISA Server, WinRoute, WinGate and etc.) you can install TrafMeter on this computer.

Switched networks

The network described in Figure 1 uses a non-switching Ethernet network hub to connect the workstations to the access router. In this scenario, all data generated by the workstations will be delivered to the TrafMeter computer.

In a switched network, a network switch (or Ethernet switch) is used to "segment" the network, to reduce network loading by blocking some data from branches of the network that do not require that data.

If an unmanaged network switch is used, it is not possible to connect the TrafMeter computer directly to the switch (even though all data passes through the switch) and an additional network hub must be installed between the switch and access router, to provide data to TrafMeter. This case is shown in Figure 3.

If a managed (or intelligent) switch is used, you can configure the switch to deliver all IP data to a "monitor" (or "spanning") port on the switch, and connect the TrafMeter computer to this port and enable promiscuous mode on the Ethernet adapter. This case is shown in Figure 4.


TrafMeter :: Filter Manager

Filter Manager

Filter Manager is intended for adding, editing, deleting or moving the filters. Moving the filters in the filterset, you change only an order of the filters in reports. The order of the filters has no influence on a program performance because the captured packet is processed by every filter.

An option Restore counters from the file after capture restart allows to restore the traffic counters in the main grid after capture restart. Normally, when you stop the capture and start it again, the traffic counters in the main grid will be dropped to zero. To avoid this situation you can enable mentioned option and specify a filename (it must not be a filename template) to store counters in the external XML file. This file is temporary and don't use this file as a final report! To create the frond-end traffic reports, use XML traffic reports feature.

You can get to the Filter Manager from the menu Traffic -> Edit filters...

Ctrl+N


TrafMeter :: Filter Editor

Filter Editor

This allows to fill all filter parameters. You can add, edit or delete here rules for the traffic counting. At least one rule listed in the filter must exactly correspond an IP packet for match IP packet to the filter. The filter can include up to 50 rules. There are some options in Filter Editor:

  • Visible. If this option is enabled then TrafMeter will draw a curve line for the filter on the graph.
  • Icon animation in tray. If this option is enabled and if traffic counters of this filter were updated on the current refresh, TrafMeter Icon in the tray will blink during the next refresh period.
  • Packet Logging feature allows to record IP packet headers into a file or into a database. It expands a program power: you can get not only the counters for IP traffic accounting, you can record IP packet headers transmitted in your network for future analysis.

Tip: For best performance, place frequently used rules at the top of a list.

You can get to the Filter Editor from Filter Manager.


TrafMeter :: Rule editor

Rule Editor

The rules establish conditions for a match between an IP packet and the filter. To match to the filter, the packet must match at least one rule listed in the filter. To match to the rule, all IP packet headers must be exactly similar to the rule conditions. The rule consists of:

  • IP protocol type (e.g., Any IP protocol, TCP, UDP, ICMP and etc)
  • Source and destination addresses (e.g., Any address, My computer, A specific IP address and etc)
  • Source and destination ports (only for TCP or UDP protocols)
  • TOS (Type of Service) field from IP protocol header
  • "Mirrored" flag. If mirrored flag is disabled, then IP packet must be exactly similar to the rule and sent bytes counter will be updated only. If mirrored flag is enabled, then rule will also work for IP packets with opposite source and destination addresses and sent & received bytes counter will be updated depending on a direction of IP packets.

Here is the example of the rule below. The sent bytes counter will be updated for TCP packets from hosts 192.168.190.0/255.255.255.0 (any port) to 192.168.4.3 (port 3128). Since "mirrored" flag is on, the received bytes counter will be updated for TCP packets from host 192.168.4.3 (port 3128) to hosts 192.168.190.0/255.255.255.0 (any port).

You can get to the Rule editor from the Filter editor


TrafMeter :: LAT

LAT (Local Address Table)

LAT is a set of IP address ranges that describes all IP addresses of your LAN. Using LAT, it is possible to create rules that will not count traffic between hosts in your LAN. Having created LAT, you can refer in the rules to the addresses listed in LAT as "IP addresses of my LAN" and to the addresses not listed in LAT as "IP addresses of WAN".

If LAT is blank, the rules included "IP addresses of my LAN" will never work and the rules included "IP addresses of WAN" will be considered as "Any IP address".

You can get to the LAT from the menu Traffic -> Edit filters...

Ctrl+N

Example

Scenario:
You are a network administrator of the small network connected to Internet that includes NAT router as an Internet Gateway (192.168.1.1), local Intranet Webserver (192.168.1.2) and four client PCs (192.168.1.3-192.168.1.6). You need to do IP traffic accounting on who how much is using your Internet Connection. You don't want to count the IP traffic between hosts in your LAN.

Solution:
You should create:
- The LAT with scope 192.168.1.1-192.168.1.255
- Four filters with rules "192.168.3.x-WAN" (one filter per host in your LAN)

Filter No. 1.
Name: Internet traffic of Host 1.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | Any | 192.168.1.3 |  | IP addresses of WAN |

Filter No. 2.
Name: Internet traffic of Host 2.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | Any | 192.168.1.4 |  | IP addresses of WAN |

Filter No. 3.
Name: Internet traffic of Host 3.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | Any | 192.168.1.5 |  | IP addresses of WAN |

Filter No. 4.
Name: Internet traffic of Host 4.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | Any | 192.168.1.6 |  | IP addresses of WAN |


TrafMeter :: XML Traffic Reports

XML Traffic Reports

XML Traffic Reports provide the easiest way to build various reports of the traffic counters for the fixed time periods. TrafMeter can produce two groups of XML Traffic Reports simultaneously. For example, the first group can create daily traffic reports and the second group can create monthly traffic reports. A type of the report for the group (daily or monthly) depends on the Filename template. If the Filename template contains a daily identifier (%d), it will create the daily traffic reports. The Filename template for the monthly traffic reports must contain a monthly identifier (%m) and must not contain the daily identifier. For example, the Filename template:

  • c:\your_company\traffic\daily\%Y-%m-%d.xml will produce the daily traffic reports
  • c:\your_company\traffic\montly\%Y-%m.xml will produce the monthly traffic reports

Why XML ?

XML is a standard language used to structure and describe data that can be understood by different applications. The power of XML is its ability to separate the user interface from the data.

How does XML Traffic Reports work in TrafMeter ?

  1. A Filename of XML report is derived from the Filename template and from the current time. Assume, if the Filename template is "c:\Traffic\%Y-%m-%d.xml" and the current date is November 24, 2002, then the Filename of XML report will be "c:\Traffic\2002-11-24.xml"
  2. Traffic counters from the file "c:\traffic\2002-11-24.xml" are loaded in a memory.
  3. Unsaved traffic counters (i.e. new traffic counters after the last successful update of the report) are added to the traffic counters stored in the memory.
  4. The traffic counters are flushed in the file "c:\traffic\2002-11-24.xml" from the memory

By default, the traffic reports are updated after the second refresh period, however the frequency of updating can be changed by editing manually the filterset file (the node ).


TrafMeter :: Formatting XML Traffic Reports with XSL style sheets

Formatting XML Traffic Reports with XSL style sheets

XSL is built around the style sheet mechanism. Style sheets are generally used to apply styles, or formatting information, consistently throughout a document. The XSL transformation language (xsl namespace) is a description of how a processor can transform an XML document from one structure to another. The transformation process in a general sense takes one document tree and transforms it into another document tree.

Here is an example of XML Traffic Report produced by TrafMeter:

<?xml version="1.0"?>
<TrafficReport>
    <Filter Id="1">
        <Name>ICMP</Name>
        <Sent>3267224</Sent>
        <Recv>3267224</Recv>
    </Filter>
    <Filter Id="2">
        <Name>TCP</Name>
        <Sent>499413566</Sent>
        <Recv>12098967</Recv>
    </Filter>
    <LastModified>November, 26 2002 11:19:14</LastModified>
</TrafficReport>

When you open this document in Microsoft Internet Explorer, it will look as follows:

This is not very clear. However, if a prolog of XML Traffic Report contains a reference to the external XSL style sheets describing a formatting of this report:

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="traffic.xsl"?>
<TrafficReport>

it will look with another view in Microsoft Internet Explorer:

The source code of traffic.xsl can be found here. You can create own XSL style sheets to customize your XML Traffic Reports as well. The other example of using XSL style sheets is follows:

This XSL (traffic2.xsl) shows the traffic counters in megabytes. The source code of traffic2.xsl can be found here.


TrafMeter :: XSL example

XSL style sheet for XML Traffic Reports. Example 1.

This is the example of XSL style (traffic.xsl) for the formatting of XML Traffic Reports

<?xml version="1.0" encoding="windows-1252"?>
<xsl:template xmlns:xsl="uri:xsl">
  <HTML>
    <BODY>
      <H3>Your company name - Daily traffic report</H3>
<table cellspacing="0" cellpadding="5" border="1">
<tr>
    <td STYLE="font-family:Arial; font-size:12">
      Id
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Name
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Sent bytes
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      Recv bytes
    </td>
</tr>

  <xsl:for-each select="TrafficReport/Filter">
<tr>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="@Id"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Name"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Sent"/>
    </td>
    <td STYLE="font-family:Arial; font-size:12">
      <xsl:value-of select="Recv"/>
    </td>

</tr>
  </xsl:for-each>

</table>

<p> <br>
<i>Last Modified:
<xsl:value-of select="TrafficReport/LastModified"/>
</i> </br></p>

    </BODY>
  </HTML>
</xsl:template>

The resulting XML Traffic Report (formatted with traffic.xsl) can be as follows:


TrafMeter :: XSL example 2

XSL style sheet for XML Traffic Reports. Example 2.

This is the example of XSL style sheet (traffic2.xsl) for the formatting of XML Traffic Reports. It shows the traffic counters in megabytes.

<?xml version="1.0" encoding="windows-1252"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<H3>Your company name - Daily traffic report</H3>
<table cellpadding="5" border="1" cellspacing="0" STYLE="font-family: verdana; font-size:12">
<tr>
 <td><B>Id</B></td>
 <td><B>Filter Name</B></td>
 <td><B>Sent bytes</B></td>
 <td><B>Recv bytes</B></td>
</tr>
<xsl:for-each select="TrafficReport/Filter">
 <tr>
 <td>
  <xsl:value-of select="@Id"/>
 </td>
 <td>
 <xsl:value-of select="Name"/>
 </td>
 <td>
 <xsl:value-of select="format-number(Sent div 1048576, '0.00')"/> Mb
 </td>
 <td>
 <xsl:value-of select="format-number(Recv div 1048576, '0.00')"/> Mb
 </td>
 </tr>
</xsl:for-each>
</table>
<p><br>
<i>Last Modified:
<xsl:value-of select="TrafficReport/LastModified"/>
</i></br></p>
</xsl:template>
</xsl:stylesheet>

The resulting XML Traffic Report (formatted with traffic2.xsl) can be as follows:


TrafMeter :: Traffic Logging into Database

Traffic Logging into Database

This allows to record the traffic counters into database and to build a fast and scalable traffic accounting system for your users. To use feature "Traffic Logging into Database" you should:

  • Specify Database Connection string (or OLE DB Connection string)
  • Specify the name of Database Table for Traffic Logging
  • Create a timestamp template for the "ts" field
  • Set a frequency of a flushing the counters into the database. The Traffic Logging into database requires more CPU's cycles than the Traffic Logging into file therefore it's recommended to update the database table not after every refresh period.

How does the Traffic logging into Database work ?

The database table is updated with the given frequency of the flushing. Assume that the name of the database table for Traffic Logging is "traffic_table" and the current date is November 24, 2002.

  1. The value of the "ts" field is calculated. It depends on the timestamp template and the current date and time. For example, if the timestamp template is "%Y%m%d" then "ts" will be 20021124.
  2. The command "SELECT * FROM traffic_table WHERE ts=20021124" is issued and the database counters stored in the table are retrieved in a temporary counters storage.
  3. Unsaved counters since the last database update are added to the counters stored in the temporary storage.
  4. The temporary counter storage is flushed into the database


TrafMeter :: Database table for Traffic Logging

Database table for Traffic Logging

To write traffic counters in a database, you must create a table with the minimal set of fields:

N | Field name | Field type | Description
1. | filterid | smallint | Filter id (from 1 to N. In general, N is a number of filters in the filterset)
2. | ts | int | Timestamp field (the old name is "timestamp" in TrafMeter 3.0 and TrafMeter 2.x. It was renamed in order to compatibility with other SQL Servers). It contains a time period for counters stored in this record. For example, if ts=20021124 then this record has the traffic counters for November, 24 2002. The value of the ts field is derived on the timestamp fied template.
3. | sent | bigint | Sent bytes counter
4. | recv | bigint | Received bytes counter

You can use the following script to create the table in Microsoft SQL Server:

CREATE TABLE [dbo].[traffic] (
   filterid smallint NOT NULL,
   ts int,
   sent bigint, recv bigint)

The same script works on MySQL database:

CREATE TABLE traffic (
   filterid smallint NOT NULL,
   ts int,
   sent bigint, recv bigint)

The next figure shows the table for Microsoft Access:


TrafMeter :: Timestamp template for the ts field

Timestamp template for the ts field

A timestamp template defines a value for the ts field in the table for the Traffic Logging. The value of the ts field is derived from the timestamp template based on the current date and time.

You can use the following identificators in the timestamp template:

%Y | - current year, 4 digits
%y | - current year, 2 last digits
%m | - current month, 2 digits
%d | - current day, 2 digits
%h | - current hour, 2 digits
%n | - current minute, 2 digits

For example, if timestamp field template is '%Y%m%d', the timestamp field will be '20020101' if current time is 1 January 2002.


TrafMeter :: Packet Logging

Packet Logging

TrafMeter can record IP packet headers of captured traffic into a plaintext file or into a database. To implement this feature, every TrafMeter filter has a special engine named "Packet Collector". The main idea of the Packet Collector is a grouping of IP packets with identical parameters because the recording of every packet is too expensive. The Packet Collector is storage for counted packets and it includes up to 1000 positions. The position of the Packet Collector consists of the following set of IP packet headers:

  • IP protocol type (1 - ICMP, 6 - TCP, 17 - UDP and etc.
    See c:\winnt\system32\drivers\etc\protocols.txt or RFC 1700 for details)
  • Source and destination IP addresses
  • Source and destination MAC addresses
  • Source and destination ports (for TCP and UDP only)
  • Sent bytes counter and received bytes counter
  • TOS (Type of Service) field

A process named "Flushing the Packet Collector" forces all positions remaining in the Packet Collector to be written into the file or into the database. The Packet Collector is flushed every specified time (from 1 to 999) of refreshing period. For example, if refreshing period is 3 seconds and flushing time is 10, then the Packet Collector will be flushed every 30 seconds. Too frequent flushing may increase a system loading. Too infrequent flushing may lead to an overflow of the Packet Collector. The overflow of the Packet Collector is marked in the logfiles as "Packet Collector is full" and you should consider to increase the size of Packet Collector.

Compressing of dynamic ports

As it known, an opening a web-page in Internet browser leads to establishing several TCP connections simultaneously since the web-page has built-in graphic images. The packets of such session have very similar characteristics that allows to reduce significantly an amount of the logging.

There are two types of TCP- and UDP-ports: "privileged" ports with numbers in the range from 0 to 1023 and "dynamic" ports with numbers in the range from 1024 to 65535. Usually, Internet services use the privileged ports to accept incoming connections and client applications use the dynamic ports to initialize outgoing connections. The number of the dynamic port is chosen in random order by the client application, therefore a logging of the dynamic ports is useless in a common case and TrafMeter uses a mode of the "Compressing of dynamic ports" by default.

TrafMeter must know who is the client and who is the server because it will replace the client port with a "magic" number 65535 before a putting the new packet in Packet Collector when the compressing of dynamic ports is enabled.

If the client application establishes a new TCP-connection to the port from the dynamic range on the server, it will mean a situation when the both ports (the client port and the server port) are in the dynamic range (1024-65535). This case will force TrafMeter to detect roles of connection peers by analyzing a packet with SYN flag.

See also:
Packet Logging into file
Packet Logging into database


TrafMeter :: Packet Logging into file

Packet Logging into file

Packet Logging into file provides an easy technique to track packets matched at least one rule listed in the filter. To use this feature you should specify a Filename Template for logfiles. Every filter must have the unique Filename Template because it has own independent Packet Collector.

An example of the logfile is shown below. The lines beginning with '---' are a time when the Packet Collector was flushed. The first column is the protocol type. The 2nd and 3rd columns are the source IP address and the source port. The 4th and 5th columns are the destination IP address and the destination port. The 6th and 7th columns are the sent bytes counter and the received bytes counter.

 proto    src_ip     src_port    dst_ip        dst_port     sent       recv

--- Time: 2002-11-12 11:31:14
  TCP     192.168.3.1 client    64.12.174.121     80           0         80
  TCP     192.168.3.1 client    64.236.16.136     80         160         40
  TCP     192.168.3.1 client    207.46.249.27     80          40         81
  TCP     192.168.3.1 client    64.236.16.116     80          40          0
  TCP     192.168.3.1 client   207.200.91.184     80         160         80

--- Time: 2002-11-12 11:31:32
  TCP     192.168.3.1 client    64.236.16.136     80         432        256

--- Time: 2002-11-12 11:31:50
  TCP     192.168.3.1 client  205.188.238.185    443        1573      13652
  TCP     192.168.3.1 client    64.12.174.121     80         772        330
  TCP     192.168.3.1 client    207.46.249.27     80          40         41
  TCP     192.168.3.1 client  205.188.238.185     80         733        795

If "Log additional fields" option is enabled you can see an another picture below. The value in the brackets after 2nd and 4th column contains source and destination MAC address correspondingly. The latest column contains a value of TOS (Type of Service) field.

--- Time: 2002-11-12 11:41:35
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)     80       11629       8154   0
  TCP     192.168.3.1 (5254ab2088ad) client     193.45.10.72 (008048c28d3d)    443          80         80   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80         567          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0       1551   16
  TCP     192.168.3.1 (5254ab2088ad) client     216.26.160.8 (008048c28d3d)    110         383        494   0
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         152        166   0

--- Time: 2002-11-12 11:41:53
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80          80          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0         40   16
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         225        412   0

Note

"client" in the third column means any dynamic port (1024-65535).


TrafMeter :: Packet Logging into database

Packet Logging into database

Packet Logging into database provides more powerful technique to store and to analyse IP packets matched at least one rule listed in the filter. To use this feature you should specify:

  • Database Connection string (or OLE DB Connection string)
  • The name of Database Table for Packet Logging

Note

You should manually create the database table before TrafMeter will record packets.

TrafMeter doesn't have a native tool for building reports from Packet Logging database. To help in creating your custom SQL-scripts to build various reports we provide some Microsoft SQL Server examples listed below.

1. Calculating the total amount of traffic for every filter

select filterid, sum(sent),sum(recv) from packets group by filterid

2. Calculating the total amount of traffic for every filter for a specific day

select filterid as filterid, sum(sent) as sent, sum(recv) as recv from packets
   where datediff(day,'2002-11-24',ts)=0
   group by filterid
   order by filterid

3. Calculating the total amount of traffic for every filter for a specific month

select filterid as filterid, sum(sent) as sent, sum(recv) as recv from packets
   where datediff(month,'2002-11-01',ts)=0
   group by filterid
   order by filterid

4. Calculating the total amount of traffic per day for a specific filter for a specific month

Set the variable @dd to the first day of desired month.

declare @dd datetime
set @dd='2002-11-01'
select datediff(day,@dd,ts) as mday, sum(sent) as sent, sum(recv) as recv
   from packets
   where (filterid=1 AND (datediff(month,@dd,ts)=0))
   group by datediff(day,@dd,ts)
   order by datediff(day,@dd,ts)

The example above shows dates with zero-based index. E.g. the first day of month will be 0, the second day of month will be 1. To avoid this problem you can use the following script with temporary table:

drop table #p1
go
declare @dd datetime
set @dd='2002-11-01'
select datediff(day,@dd,ts) as mday, sum(sent) as sent, sum(recv) as recv
   into #p1
   from packets
   where (filterid=1 AND (datediff(month,@dd,ts)=0))
   group by datediff(day,@dd,ts)
go
update #p1 set mday=mday+1
go
select * from #p1 order by mday

5. Calculating the total amount of traffic per host for a specific filter for a specific month

select dst_ip, sum(sent) as sent, sum(recv) as recv
   from packets
   where (filterid=1 AND (datediff(month,'2002-11-01',ts)=0))
   group by dst_ip


TrafMeter :: Database Table for Packet Logging

Database Table for Packet Logging

You must manually create the table in the database before TrafMeter will record IP packets. A minimal set of the fields in the table is:

N | Field name | Field type | Description
1. | filterid | smallint | Filter id (from 1 to N. In general, N is a number of filters in the filterset)
2. | proto | smallint | IP protocol type (1 - ICMP, 6 - TCP, 17 - UDP and etc. See "protocols.txt" for details)
3. | src_ip | char(16) | Source address IP (in decimal-dotted notation, e.g. 192.168.3.250)
4. | src_port | int | Source port (for TCP or UDP only, the range is 0 - 65535)
5. | dst_ip | char(16) | Destination address IP
6. | dst_port | int | Destination port (for TCP or UDP only)
7. | sent | int | Sent bytes counter
8. | recv | int | Received bytes counter

In additional, if you enable a logging of MAC addresses, TOS (Type of Service) field or Filter Name in the packets database, you should create additional fields in the table:

N | Field name | Field type | Description
9. | src_mac | char(16) | Source MAC address (e.g. 1a2c3e4d556f)
10. | dst_mac | char(16) | Destination MAC address
11. | tos | smallint | TOS (Type of Service) field (the range is 0-255)
12. | filtername | char(30) | The filter name (The length of this field must be the length of the longest Filter Name in the filterset)

See also:
Microsoft SQL Server Syntax to create the table for Packet Logging
MySQL Server Syntax to create the table for Packet Logging
Microsoft Access Syntax to create the table for Packet Logging


TrafMeter :: Microsoft SQL Server Syntax to create the table for Packet Logging

Microsoft SQL Server Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

CREATE TABLE [dbo].[packets] (
   ts datetime DEFAULT CURRENT_TIMESTAMP NOT NULL,
   filterid smallint NOT NULL,
   proto smallint,
   src_ip char(16),
   src_port int,
   dst_ip char(16),
   dst_port int,
   sent int, recv int)

To create the table for Packet Logging with additional fields:

CREATE TABLE [dbo].[packets] (
   ts datetime DEFAULT CURRENT_TIMESTAMP NOT NULL,
   filterid smallint NOT NULL,
   filtername char(30),
   proto smallint,
   tos smallint,
   src_mac char(16),
   src_ip char(16),
   src_port int,
   dst_mac char(16),
   dst_ip char(16),
   dst_port int,
   sent int, recv int)

Note

Microsoft SQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use CURRENT_TIMESTAMP function for this purpose.


TrafMeter :: MySQL Server Syntax to create the table for Packet Logging

MySQL Server Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

create table packets (
   ts timestamp,
   filterid smallint  NOT NULL,
   proto tinyint,
   src_ip char(16),
   src_port smallint unsigned,
   dst_ip char(16),
   dst_port smallint unsigned,
   sent int unsigned, recv int unsigned);

To create the table for Packet Logging with additional fields:

create table packets (
   ts timestamp,
   filterid smallint NOT NULL,
   filtername char(30),
   proto tinyint,
   tos tinyint,
   src_ip char(16),
   src_mac char(16),
   src_port smallint unsigned,
   dst_ip char(16),
   dst_mac char(16),
   dst_port smallint unsigned,
   sent int unsigned, recv int unsigned);

Note

MySQL Server must automatically insert the current date and time in the table with new record. Therefore, you should use the field with "timestamp" type.


TrafMeter :: Packet Logging :: Microsoft Access Syntax to create the table for Packet Logging

Microsoft Access Syntax to create the table for Packet Logging

To create the table for Packet Logging with a minimal set of fields:

To create the table for Packet Logging with additional fields:

Note

Microsoft Access must automatically insert the current date and time in the table with new record. Therefore, you should use the field with Now() function as default value.


TrafMeter :: Packet Logging advanced settings

Packet Logging advanced settings

This dialog box allows to edit advanced settings for Packet Logging.

  • Log additional fields. This enables a logging of additional fields. When using the database, be sure that a database table for Packet Logging consists of an extended set of fields.
  • Packet Collector Size. This sets the size of Packet Collector in positions. The size of Packet Collector is not measured in bytes. Consider to increase the size of Packet Collector when message "Packet Collector overflow" will appear in log files many times.
  • Frequency of Packet Collector flushing. This defines how often a data from Packet Collector will be flushed into the file or into the database.
  • Do not compress info about dynamic TCP/UDP ports. Enable/disable a compressing of dynamic ports.


TrafMeter :: Options

Options Dialogbox

Some Trafmeter options are common for every filterset. They are stored in a registry.

  • Graph. This allows to change a vertical scale of graph, to set a refresh period and to customize colors of the graph.
  • Startup. This specifies a filterset that will be loaded automatically after TrafMeter startup.
  • Password. You can protect some TrafMeter actions by a password.
  • Application log. This enables the Application log to record TrafMeter events and errors.


TrafMeter :: Dialup Connection

How to count the traffic on Dial-up Connection ?

Windows 9x/ME

Select PPP adapter as a capturing device.

Windows NT/2000/XP

You need to install Network Monitor Driver before a capturing traffic on Dial-up Connection. To install the Network Monitor driver

  1. Log on as an administrator and Open Network and Dial-up Connections
  2. In Network and Dial-up Connections, click Local Area Connection, click the File menu, and then click Properties.
  3. In the Local Area Connection Properties dialog box, click Install.
  4. In the Select Network Component Type dialog box, click Protocol, and then click Add.
  5. In the Select Network Protocol dialog box, click Network Monitor Driver, and then click OK.
  6. If you are prompted for additional files, insert your Windows 2000 compact disc, or type a path to the location of the files on the network.
  7. Reboot your PC
  8. Open Network and Dial-up Connections and enable Network Monitor Driver for your Dial-up Connection:
  9. Run TrafMeter and select NdisWanBh as capturing device.

Have a nice traffic counting!


TrafMeter :: Running as a service

Running TrafMeter as a Windows NT/2000/XP service

TrafMeter is designed to be run as a normal application, started via the Windows Start menu. However, you can start TrafMeter as the service using FireDaemon. FireDaemon is an utility that allows to install and run many applications as the Windows NT/2000/XP Service.

Software requirements for FireDaemon v 1.5:
- Windows NT SP3+
- Windows 2000 SP1+
- Windows XP

Steps to run TrafMeter as the service are:

  1. Download FireDaemon from www.firedaemon.com. There are two versions of FireDaemon: the Lite and Pro versions. The FireDaemon Lite is free to run 1 service. The FireDaemon Pro has no restrictions on maximum installable services however it costs from $25.
  2. Run FireDaemon Service Manager
  3. Press Ctrl+N to invoke New Service Definition
  4. In the New Service Definition dialog box, select Program tab and fill the fields as follows:
  5. Select Settings tab and enable Interact with Desktop option
  6. Click Install button

Note

TrafMeter 3.20 or higher doesn't work as the service under Windows NT 4.0.


TrafMeter :: FAQ

Q: What is WinPcap?

A: WinPcap is Free Packet Capture Driver for Windows developed by the Politecnico di Torino, and its contributors. WinPcap 2.3 or higher must be installed on your computer before you run TrafMeter. WinPcap includes a kernel-level packet filter, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (wpcap.dll). The packet filter is a device driver that adds to Windows 95, 98, ME, NT, 2000 and XP the ability to capture and send raw data from a network card, with the possibility to filter and store in a buffer the captured packets.

Winpcap home page is http://winpcap.polito.it.

Q: TrafMeter can't detect network adapters installed. How to resolve this problem?

A: Send us the file "adapters_TrafMeter.txt" from TrafMeter's startup folder.

Q: Is it possible to run TrafMeter as a Windows NT/2000/XP service?

A: You can run TrafMeter as the service using freeware tool FireDaemon. See HOWTO

Q: I had to configure TrafMeter again after installing TrafMeter as the service. What's wrong?

A: Don't worry. It's normal behavior. TrafMeter stores own settings in HKCU\Software\ when running as a normal application and in HKU\.Default\Software\ when running as the service. To have a possibility of configuring TrafMeter as service, install it with enabled "Allow interact with desktop" option.

Q: Is it possible to run multiple TrafMeter instances at the same machine?

A: Run TrafMeter.exe with key /2 in a command line. Use keys /3, /4 to run third and fourth instances consistently. You can run up to 30 TrafMeter instances simultaneously.

Q: I run TrafMeter and select network adapter, but button "Start capture" is dimmed. What's wrong?

A: To start capture packets and count traffic you must create at least one filter. Read Quick start guide.

Q: I have a network adapter Realtek 8139 installed on my PC. But TrafMeter shows "NDIS 5.0 driver" instead "Realtek 8139" in the combobox. What's wrong?

A: Nothing. Some adapters (e.g., Realtek 8139) are detected as "NDIS 5.0 driver". This is normal behaviour of WinPcap driver.

Q: Does TrafMeter count IPv6 packets ?

A: No. Only IPv4 is supported.

Q: I have two network adapters (NIC) of the same type installed on my PC running Windows 98/ME. The first NIC connected to internal network has IP address 192.168.3.1 and the second NIC connected to external network has IP address 192.168.8.5. TrafMeter shows both NIC with the same description and with the same IP address 192.168.3.1 and I don't know how to choose NIC connected to internal network. What should I do ?

A: Unfortunately, this is very hard situation for WinPcap. Replace one NIC with another type.

Q: I installed WinPcap through the setup program provided on the website, but this program was too fast to install something. What was wrong?

A: Nothing. WinPcap has correctly installed and the driver and DLLs were correctly copied to the system folder. It is simply very fast, which is not usual in Windows. You can now run the applications.

Q: Can I use WinPcap on a PPP connection?

A: See HOWTO.

Q: Does WinPcap support loopback devices?

A: No. Only physical interfaces are supported. This is a limitation of Windows and not of WinPcap.

Q: Does TrafMeter have firewall features?

A: No.


TrafMeter :: Traffic counting questions

Traffic counting questions

Q: What is a technique to calculate the length of IP packet in TrafMeter ?

A: Every IP packet has a field in the header named "Total length". It contains the number of bytes in the entire packet, including the header. TrafMeter uses only value obtained in this field to calculate the length of IP packet.

Q: I have created a filter with the rule from "Any address" to "Any address" with mirrored flag is enabled. The "sent bytes" cell displays a number is very closely to captured traffic but the "received bytes" cell is zero. Incoming traffic isn't counted. What's wrong ?

A: You can't split the traffic (sent & received) in the rule "from Any to Any". Imagine that you stay at a side of a two-way road and you see a car traffic. What cars are incoming and what cars are outgoing? You can't answer because you need to get a reference point. Let's decide, the cars to the city "A" are inbound traffic and the cars to the city "B" are outgoing traffic.

Q: I have a connection to Internet via DSL modem plugged into an Ethernet hub and want to monitor traffic between my PC and Internet. My PC has the IP address 192.168.1.2 and DSL modem has the IP address 192.168.1.1. I have created a TrafMeter filter with a rule "192.168.1.2 as source address" and "192.168.1.1 as destination address". I begin capture traffic but all counters are zero. What's wrong ?

A: You measure the traffic between your PC and your DSL modem. This is your mistake. Packets transmitted from your PC to Internet don't have the IP address of your DSL modem as destination. First, fill a Local Address Table (LAT) with all addresses of your network (e.g., from 192.168.1.1 to 192.168.1.255). Second, create the filter with the rule "192.168.1.2 as source address" and "IP addresses of WAN as destination address".

Q: How to measure FTP traffic ?

A: This is a good introduction of FTP protocol obtained from www.deerfield.com. FTP is an acronym that stands for "File Transfer Protocol". FTP is used for transferring files over the Internet. There are 2 types of FTP connections, Active FTP and Passive FTP. The rules that you will require to count FTP are dependant on which mode of FTP you are using. The default behavior for most browsers is to use Passive FTP, while for most FTP Client programs (i.e. CuteFTP, Internet Neighborhood, WS-FTP) it is Active.

FTP consists of 2 unique connections between the client machine and the FTP server. One is called the "control" connection. This handles the user connecting to and logging into the FTP server. Once the user is logged in, the "data" connection is established to permit the listing of files in a directory, and allow for files to be uploaded or downloaded.

The "control" connection is the same for both Passive and Active FTP. The client makes the initial TCP connection from their temporary range of ports (i.e. any available port higher than 1023) to the server’s port 21 and says "Hi! I want to connect with you. Here is my user name and password". What happens next depends on whether Active or Passive mode is being used.

In Active mode, when the client says "Hi!" and logs in, they also tell the server a port number (again, somewhere in the temporary range) to use to connect back to them on to make the data connection. The FTP server logs the user in and then connects back to them from the server’s port 20 to the port that was given to open the data connection.

In Passive mode, after the client says "Hi!" and logs in, the FTP server logs them in, then tells the client what port to connect to the server on to make the data connection (this will be a port in the temporary range, 1024+). The client receives that information, then connects back from a temporary port to the FTP server on the port they were instructed to use, to open the data connection.

The major difference between Active and Passive mode FTP is which side is opening the data connection. In Active mode, the client machine needs to accept a data connection originating from the FTP server. In Passive mode, the client machine is always the one originating the connection.

Active Mode Example:
[1] Control Connection: Client port 1026 -> Server port 21
[2] Data Connection: Client port 1027 <- Server port 20

Passive Mode Example:
[1] Control Connection: Client port 1026 -> Server port 21
[2] Data Connection: Client port 1027 -> Server port 2065

We hope, that this information will help to create rules to count FTP traffic.


TrafMeter :: Example 1

Example 1

Scenario:
Monitor and count the IP traffic from my computer (the outbound IP packets) and the IP traffic to my computer (the inbound IP packets).

Solution:
Let's create two filters. The first filter will count the outbound IP packets. The second filter will count the inbound IP packets.

Filter No. 1.
Name: From my computer to any computer (outbound IP traffic).

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | No | Any | My computer |  | Any IP address |

The outbound IP traffic will correspond to the sent bytes counter of this filter.

Filter No. 2.
Name: From my computer to any computer (inbound IP traffic).

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | No | Any | Any IP address |  | My address |

The inbound IP traffic will correspond to the sent bytes counter of this filter.


TrafMeter :: Example 2

Example 2 (the same as example 1 but with another solution)

Scenario:
Monitor and count the IP traffic from my computer (the outbound IP packets) and the IP traffic to my computer (the inbound IP packets).

Solution:
Let's create one filter. This filter will count the outbound and inbound IP packets simultaneously.

Filter No. 1.
Name: From my computer to any computer.

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | Any | My computer |  | Any IP address |

The sent bytes counter will count the IP traffic from my computer and the received bytes counter will count the IP traffic to my computer. The received bytes counter works only with the filters which consist of the rules with mirrored flag up.


TrafMeter :: Example 3

Example 3

Scenario:
Monitor and count the IP traffic from a specific computer (e.g., 192.168.1.2) and from a specific application (e.g., Microsoft Internet Explorer) to any web-server. Let's assume that this browser generates HTTP requests only to standard TCP port 80 and to secure TCP port 443.

Solution:
Let us create one filter. This filter is intended only for monitoring outbound and inbound HTTP traffic (standard and secure) simultaneously from the specific computer 192.168.1.2 to any host.

Filter No. 1.
Name: HTTP/HTTPS traffic from my computer to any host.

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | TCP | 192.168.1.2 | Any | Any IP address | 80
2 | Yes | TCP | 192.168.1.2 | Any | Any IP address | 443

The outbound HTTP traffic (standard and secure) corresponds to the sent bytes counter and the inbound HTTP traffic (standard and secure) corresponds to the received bytes counter.


TrafMeter :: Example 4

Example 4

Scenario:
You are an administrator of your corporate Lotus Notes server (e.g., the server has the IP address 216.106.88.42). The server accepts incoming connections (Lotus Notes and SMTP) from other servers and initiates outgoing connection (Lotus Notes and SMTP). You want to monitor and count the Lotus Notus traffic and SMTP mail traffic. Let's assume, that the Lotus Notes traffic uses TCP port 1352 and the SMTP protocol uses TCP port number 25.

Solution:
You need to create four filters.

Filter No. 1.
Name: The outgoing Lotus Notes connections.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | TCP | 216.106.88.42 | Any | Any IP address | 1352

Filter No. 2.
Name: The incoming Lotus Notes connections.

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | TCP | 216.106.88.42 | 25 | Any IP address | Any

Filter No. 3.
The outgoing SMTP mail.

Rules of the filter:
Rule number | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | TCP | 216.106.88.42 | Any | Any IP address | 25

Filter No. 4.
The incoming SMTP mail.

Rules of the filter:
N | Mirrored flag | Protocol type | Source address | Source port | Destination address | Destination port
1 | Yes | TCP | 216.106.88.42 | 25 | Any IP address | Any


TrafMeter :: Ethernet

What is Ethernet ?

Ethernet works on a principle called "Carrier Sense Multiple Access / Collision Detect" or "CSMA/CD". "Multiple Access" refers to the way multiple computers access a single Ethernet segment. Originally, this meant a single coax segment. Now this refers to all stations on the same "side" of a network switch or bridge. "Carrier Sense" means that each station on an Ethernet segment can determine if any other station is transmitting. This way, if one station is transmitting, another won't begin. However, if two stations begin transmitting at roughly the same time, carrier sense will not prevent the two transmissions from interfering with each other. This is known as a collision. The "Collision Detect" feature of Ethernet will allow a station that is transmitting to detect when another station is also transmitting (and a collision has occurred), and it will then send a jamming signal to all stations on the Ethernet segment. When this signal is received, each station will cease transmission, and will begin a randomized countdown to determine when it can transmit again.


TrafMeter :: What is the difference between an Ethernet hub and switch?

What is the difference between an Ethernet hub and switch?

When a hub receives a packet (chunk) of data (a frame in Ethernet lingo) at one of its ports from a PC on the network, it transmits (repeats) the packet to all of its ports and, thus, to all of the other PCs on the network. If two or more PCs on the network try to send packets at the same time a collision is said to occur. When that happens all of the PCs have to go though a routine to resolve the conflict. The process is proscribed in the Ethernet Carrier Sense Multiple Access with Collision Detection (CSMA/CD) protocol. Each Ethernet Adapter has both a receiver and a transmitter. If the adapters didn't have to listen with their receivers for collisions they would be able to send data at the same time they are receiving it (full duplex). Because they have to operate at half duplex (data flows one way at a time) and a hub retransmits data from one PC to all of the PCs, the maximum bandwidth is 100 Mhz and that bandwidth is shared by all of the PC's connected to the hub. The result is when a person using a computer on a hub downloads a large file or group of files from another computer the network becomes congested. In a 10 Mhz 10Base-T network the affect is to slow the network to nearly a crawl. The affect on a small, 100 Mhz, 5-port network is not as significant.

An Ethernet switch automatically divides the network into multiple segments, acts as a high-speed, selective bridge between the segments, and supports simultaneous connections of multiple pairs of computers which don't compete with other pairs of computers for network bandwidth. It accomplishes this by maintaining a table of each destination address and its port. When the switch receives a packet, it reads the destination address from the header information in the packet, establishes a temporary connection between the source and destination ports, sends the packet on its way, and then terminates the connection. High-speed electronics in the switch automatically connect the end of one cable (source port) from a sending computer to the end of another cable (destination port) going to the receiving computer on a per packet basis. Multiple connections like this can occur simultaneously.


TrafMeter :: Filename Template

Filename Template

Filename Template allows an automatic constructing of filenames for logfiles and reports to simplify its rotating. The resulting filename is derived from the Filename Template based on the current system time. For example, the Filename Template:

   c:\TrafMeter\Counter_%Y-%M-%d.txt

will be filename

   c:\TrafMeter\Counter_2002-Jan-01.txt

if system time is 1 January 2002. You can use the following identifiers in the Filename Template:

%Y | - current year, 4 digits
%y | - current year, 2 last digits
%m | - current month, 2 digits
%M | - current month, 3 letter (for example, Feb)
%d | - current day, 2 digits
%h | - current hour, 2 digits
%n | - current minute, 2 digits

TrafMeter can create folders for files with unlimited nested level. For example, the Filename Template:

   c:\Reports\traffic\Enterprise\Departments\User1\%M\%d.txt

will create folder c:\Reports\traffic\Enterprise\Departments\User1\Jan\


TrafMeter :: ICMP

ICMP protocol

Internet Control Message Protocol (ICMP) defines a small number of messages used for diagnostic and management purposes. ICMP depends on IP to move packets around the network on its behalf.

ICMP is basically IP's internal network management protocol and is not intended for use by applications. Two well known exceptions are the ping and traceroute diagnostic utilities:

  • ping sends and receives ICMP "ECHO" packets, where the response packet can be taken as evidence that the target host is at least minimally active on the network, and
  • traceroute sends UDP packets and infers the route taken to the target from ICMP "TIME-TO-LIVE EXCEEDED" or "PORT UNREACHABLE" packets returned by the network. (Microsoft's TRACERT sends ICMP "ECHO" packets rather than UDP packets, and so receives ICMP "TIME-TO-LIVE EXCEEDED" or "ECHO RESPONSE" packets in return.)


TrafMeter :: IP address

IP address

An IP address is an address for a station or other device on the Internet. This type of address consists of 4 bytes, which are represented as decimal values separated by periods, as in 123.45.67.89. In order to ensure uniqueness, IP addresses are assigned in part by the Internet Assigned Numbers Authority (IANA).


TrafMeter :: IP protocol

IP protocol

IP is the widely supported network layer protocol for the Internet. IP is one of the protocols in the TCP/IP protocol suite.

This protocol defines and routes datagrams accross the Internet and provides connectionless transport service. IP protocol uses packet switching and makes a best effort to deliver its packets. The IP protocol uses the services of the data-link layer to accomplish the actual transmission along the path.

An IP packet consists of a header and data, known as a payload. The header consists of the following:

  • Version: The version of IP being used. Version 4 is currently standard.
  • IP packet header length: The number of 32-bit words used in the header. Padding is used to make sure the header ends in a 32-bit boundary.
  • Tos (Type of Service): The type of handling and delays that are allowed for the packet. The details of this field are currently in flux.
  • Total length: The number of bytes in the entire packet, including the header.
  • ID: A value created by sender to identify the packet so its components can be found and reassembled if the packet must be fragmented during its travels.
  • Flags: Three bits that are used to indicate whether the original IP packet has been fragmented and, if so, whether the current packet is the last fragment.
  • Fragment offset: Thirteen bits that specify the location of the fragment in the original packet.
  • TTL (Time To Live): Originally, this field indicated the number of seconds the packet was allowed to travel in a network before being destroyed. Now it is interpreted as a hop count value and is generally assigned a default value of 32. The contents of this field are decreased at each router to which the packet is passed.
  • Protocol: This value specifies the higher-level protocol contained in the packet's data field. For example, 1 is ICMP, 6 is TCP, 17 is UDP.
  • Checksum: This value is used to make sure the header has not been corrupted or changed during its travel.
  • Source Address: The IP address of the sender.
  • Destination Address: The IP address of the destination node.
  • Options: There may be up to three Option field. The interpretations for these fields may be defined by the user of the protocol.
  • Padding: This field is used to make sure the header ends on a 32-bit boundary.
  • Data: This field contains material from a higher-level protocol.


TrafMeter :: Hardware address

MAC address

A MAC address, also know as a physical address or a hardware address, is a unique numerical value assigned to a network interface card (NIC) during the manufacturing process or by setting jumpers or switches during network installation. One part of this address is assigned to the manufacturer by the IEEE (Institute of Electronics Engineers) and is common to all components from that manufacturer; the second part of the hardware address is a unique value assigned by the hardware manufacturer.

For example, the physical address (or MAC address) of ethernet adapter can be 52-54-AB-20-88-AD. TrafMeter allows to create rules with MAC address as source or/and destination addresses.


TrafMeter :: OLE DB Connection String

OLE DB Connection String

An OLE DB Connection String is a connection string to a database. It includes a type of the database server, the server name, security attributes and etc.

OLE DB is a set of a COM interfaces. They provide to TrafMeter an uniform data access to various data sources regardless of a data location or data types. ADO (ActiveX Data Objects) implements a high-performance interface for OLE DB.

Installing ADO on your Computer

To properly install ADO on your computer, you need to install MDAC (Microsoft Data Access Components). This installs both ADO and necessary underlying ADO components. MDAC is available free for download from the Web at the following URL:

http://www.microsoft.com/data

Creating OLE DB Connection String

The connection string has a complex syntax. For example, the connection string for Microsoft SQL Server can be as follows:

SQLOLEDB.1;Password=trafmeter;Persist Security Info=True;
User ID=meter;Initial Catalog=traffic;Data Source=SERVERNAME

The connection string can be stored in special file also known as "data link file" or a UDL file (*.udl). You can use a UDL Wizard to create the UDL file. Having created the UDL file, you can refer to it in the connection string as follows:

File Name=c:\DataLinks\trafmeter.udl

If you change database or network configuration, you can simply modify the UDL file and distribute its new version.

Creating the OLE DB Connection String for Microsoft SQL Server Database

Warning! You must create SQL Server account and database before making the connection string.

  • Create an empty file with *.udl extension, for example, trafmeter.udl
  • Open a Windows Explorer and click the created file (trafmeter.udl). An application "Data Link Properties" must be launched
  • Select "Microsoft OLE DB Provider for SQL Server" and click the "Next" button
  • Fill the fields on the tab "Connection" and click the "Test" and "OK" button. The connection string will be stored in the UDL file:

Creating the OLE DB Connection String for Microsoft Access Database

Warning! You must create Microsoft Access database before making the connection string.

  • Create an empty file with *.udl extension, for example, trafmeter.udl
  • Open a Windows Explorer and click the created file (trafmeter.udl). An application "Data Link Properties" must be launched
  • Select "Microsoft OLE DB Provider for ODBC drivers" and click the "Next" button
  • Fill the fields on the tab "Connection" and click the "Test" and "OK" button. The connection string will be stored in the UDL file:

See also: Creating an OLE DB Connection String for MySQL Server Database


TrafMeter :: Creating an OLE DB Connection String for MySQL Server Database

Creating an OLE DB Connection String for MySQL Server Database

Download from www.mysql.com the latest MySQL ODBC Driver.

  • Create an empty file with *.udl extension, for example, trafmeter.udl
  • Open a Windows Explorer and click the created file (trafmeter.udl). An application "Data Link Properties" must be launched
  • Select "Microsoft OLE DB Provider for ODBC drivers" and click the "Next" button
  • Select "Use connection string" and click on "Build..." button:
  • Click on "New..." button in a dialog "Select Data Sources". A dialog "Create New Data Source" will be appeare. Select "MySQL ODBC 3.x Driver" and click on "Next" button.
  • Type a name of a Data Source Name (DSN), for example, "mysql_linux" and click on "Next" button. Click on "Next" button in the next dialog box.
  • Type a name or address of MySQL server, a database name, a username and a password. Click on "Test Data Source" button to ensure that all parameters are filled correctrly.
  • Go back in "Microsoft Data Link Properties" and click on "OK" button to save the settings.


TrafMeter :: Port

Port

A port can be considered of as a "virtual slot" for TCP or UDP protocols that is used to map a connection between 2 hosts. Ports are numbered from 0 to 65535, with the range 1 to 1023 commonly referred to as "priviledged", and the range 1024 to 65535 as "dynamic". There are basically two uses for ports:

  1. listening on a port – used by server applications waiting for users to connect to a well-known service i.e. HTTP (TCP port 80), POP3 (TCP port 110) or DNS (UDP port 53)
  2. opening a dynamic port – both sides of a TCP connection need to be identified by IP addresses and port numbers. Therefore, when you want to connect to a server, your end of the communications channel also needs a port. This is done by choosing a port above 1024 on your computer that is not currently in use by another communication channel, and using it as the sending port in the new connection. Dynamic ports may also be used as "listening" ports in some applications, such as FTP.

Ports in the range 0-1023 are almost always server ports. Ports in the range 1024-65535 are usually ports that are opened dynamically when you connect to a server port. However, any port may be used as a server port, and any port may be used as an outgoing port.


TrafMeter :: Promiscuous mode

Promiscuous mode

In a Ethernet local area network (LAN), promiscuous mode is a mode of operation in which every data packet transmitted is received and read by every network adapter. Promiscuous mode must be supported by each network adapter as well as by the input/output driver in the host operating system. Promiscuous mode is often used to monitor network activity. Promiscuous mode is the opposite of non-promiscuous mode. When a data packet is transmitted in non-promiscuous mode, all the LAN devices "hear" the data to determine if the network address included in the data packet is theirs. If it isn't, the data packet is passed onto the next LAN device until the device with the correct network address is reached. That device then receives and reads the data.


TrafMeter :: TCP

TCP protocol

Transmission Control Protocol (TCP) provides a reliable byte-stream transfer service between two endpoints on an internet. TCP depends on IP to move packets around the network on its behalf. IP is inherently unreliable, so TCP protects against data loss, data corruption, packet reordering and data duplication by adding checksums and sequence numbers to transmitted data and, on the receiving side, sending back packets that acknowledge the receipt of data.

Before sending data across the network, TCP establishes a connection with the destination via an exchange of management packets. The connection is destroyed, again via an exchange of management packets, when the application that was using TCP indicates that no more data will be transferred. In OSI terms, TCP is a Connection-Oriented Acknowledged Transport protocol.

TCP has a multi-stage flow-control mechanism which continuously adjusts the sender's data rate in an attempt to achieve maximum data throughput while avoiding congestion and subsequent packet losses in the network. It also attempts to make the best use of network resources by packing as much data as possible into a single IP packet, although this behaviour can be overridden by applications that demand immediate data transfer and don't care about the inefficiencies of small network packets.


TrafMeter :: UDP

UDP protocol

User Datagram Protocol (UDP) provides an unreliable packetized data transfer service between endpoints on an internet. UDP depends on IP to move packets around the network on its behalf.

UDP does not guarantee to actually deliver the data to the destination, nor does it guarantee that data packets will be delivered to the destination in the order in which they were sent by the source, nor does it guarantee that only one copy of the data will be delivered to the destination. UDP does guarantee data integrity, and it does this by adding a checksum to the data before transmission. (Some machines run with UDP checksum generation disabled, in which case data corruption or truncation can go undetected. Very few people think this is a good idea.)


TrafMeter :: Creating an OLE DB Connection String for Microsoft Access Database

Creating an OLE DB Connection String for Microsoft Access Database

Warning! You must create Microsoft Access database before making the connection string.

  • Create an empty file with *.udl extension, for example, trafmeter.udl
  • Open a Windows Explorer and click the created file (trafmeter.udl). An application "Data Link Properties" must be launched
  • Select "Microsoft OLE DB Provider for ODBC drivers" and click the "Next" button
  • Fill the fields on the tab "Connection" and click the "Test" and "OK" button. The connection string will be stored in the UDL file:


TrafMeter :: Creating an OLE DB Connection String for Microsoft SQL Server Database

Creating an OLE DB Connection String for Microsoft SQL Server Database

Warning! You must create SQL Server account and database before making the connection string.

  • Create an empty file with *.udl extension, for example, trafmeter.udl
  • Open a Windows Explorer and click the created file (trafmeter.udl). An application "Data Link Properties" must be launched
  • Select "Microsoft OLE DB Provider for SQL Server" and click the "Next" button
  • Fill the fields on the tab "Connection" and click the "Test" and "OK" button. The connection string will be stored in the UDL file: