Re: flow monitoring recommendations

For basic logging one can use IPF, or presumably PF or NPF, to simply
log all TCP "flows", albeit in a not-necessarily-so-useful format:

	log in proto tcp from any to any flags S/SAFR

To that I also add the following, but to be more useful there should be
per interface rules as well, and perhaps even some for interesting
internal and/or external hosts:

	count in from any to any
	count out from any to any

Too bad pf(4) in NetBSD does not (yet) include pflow(4) and related
tools.  It's been in the original OpenBSD for nearly a decade now.
FreeBSD also has a NetGraph module, ng_netflow(4), for collecting
NetFlow(tm) data.

--
					Greg A. Woods <[email protected]>

Kelowna, BC     +1 250 762-7675           RoboHack <[email protected]>
Planix, Inc. <[email protected]>     Avoncote Farms <[email protected]>

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRuK6dmwVAucmRxuh9mfXG3eL/0fwUCZwBbpQAKCRBmfXG3eL/0
fwfYAJ0Zepua5SpeDjgieJJ4rXpRBgvCfgCgg7rdnrlZvoQcNybFiUDf1glaQOo=
=4zYc
-----END PGP SIGNATURE-----