Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : New approach to bandwidth monitoring?

[Jake29]

Okay- this is admittedly a half-baked proto-idea, and i'm not sure if it is even feasible, but I would like to hear other people's thoughts:

What I have learned about bandwidth monitoring is that the only elegant and comprehensive solution is to do bandwidth monitoring via ip addresses using a tool like bandmin, ntop, etc. So in a "reseller environment", each reseller gets and real, global IP address, so that the server owner can bill them for all the traffic of their site and all thier virtual hosts. The reseller, however, is unable to have the same ability to bill thier customers accurately, and at best can tally a set of log files for a more-or-less close approximation.

What I am wondering is whether there would be a way to set up a "virtual lan", so that each virtual host would have an lan ip, ie 10.0.0.1, 10.0.0.2, etc. You can do something like this for apache using mod_proxy and mod_rewrite, but of course, that would only be http traffic, and that's covered by log files. Is there some weird DNS chaining that could be done, so

Global DNS: example.com ==> public ip 204.x.x.x
Local DNS @ 204.x.x.x: example.com ==> local ip 10.x.x.x?

Now the bandwidth monitor can record all traffic for each 10.x.x.x, and each virtual host's traffic can be billed and reported accurately!

If anyone has any idea of what I am talking about, and has any suggestions on how it might be implemented, I would greatly appreciate your thoughts.

half-baked, proto-Jake29

[jstout]

I think it could be done but you would run into problems with NAT when you started pushing decent amounts of bandwidth.

[Starhost]

Don't do that! It looks nice at first but when you have loads of servers their. Your router won't handle it!

What I suggest is to monitor incomming and outcomming traffic for every user. And then count the total of all user (for a vhost) together for the correct bandwaidth :-)

Or just use webalizer and process the amount of datatraffic by running a simple PHP script :-) And just add for example 10% (for email / ftp traffic).

suc6.

[priyadi]

[i]
Or just use webalizer and process the amount of datatraffic by running a simple PHP script :-) And just add for example 10% (for email / ftp traffic).
[/B]

Won't work. I've seen users who use email very extensively, and hardly use any web traffic at all.

[Starhost]

Then how would you suggest keeping track of email activity for bandwisth monitoring? Because I really don't know a way to handle that.

[webx]

Any qmail logs?

The sendmail logs do describe the size of email. So processing them you can find the traffic for each domain.

[Starhost]

I use EXIM, and haven't find anything (yet) to process them to calculate bandwidth. I'll investigate that tonight. But woudn't it be easier to just calculate www+ftp and than add a percentage? Because mail isn't used that often. And further more I don't let my customers send mail by mij server (not from a mail client).

[priyadi]

A few thing to note for those who want to calculate bandwidth on HTTP traffic.

- web server access_log doesn't log HTTP request, most HTTP request are small and therefore negligible, however things like file uploads can be very significant

- it doesn't take HTTP headers into calculation, for both requests and response.

- nph CGI scripts don't generate correct bytes count in access_log

The world is not perfect

[Starhost]

May I ask you how you would calculate bandwidth?

(while using the namebased host option in apache)

[kindred]

Depending on how "virtual" your customers are, its pretty simple to setup a perl module to watch packets in and out of the system.

That would then be fine for web/ftp where the customer has their own IP, and for mail you'd have to make sure they make the MX records point to their IP again and not your main server.

Same goes for any service, as long as you can get them to use their own IP (which could also be enforced with user id's in an ACL, which for example ipfw can do).

I played around with PCAP the other day, and managed to make pretty little graphs of every IP aliases on my interface (in bits/sec, ala MRTG/Cricket) using RRDTool.

Lots of options I think, just many ways to do it - some more accurate than others.

Andy.

[Jake29]

Vexing, Isn't it?!?!? When you start to dig a little, basing bandwidth on log files is extremely deficient. There have been a lot of complaints w/ cpanel's inaccuracies, and one reason that I've been avoiding going that route is that there have been so many complaints. What i've been learning is that these aren't really so much deficiencies in cpanel, as much as they are industry-wide systemic flaws in the way virtual hosting is done.

Jake

[Starhost]

kindred,

You are talking of per IP. That would mean that EVERY customer on my server would need their own IP. And with the current situation, RIPE isn't providing that much IP's for this kind of stuff.

So how you say it I wouldn't call it virtualhosting. But Ip-based hosting.

[kindred]

Originally posted by Starhost
kindred,

You are talking of per IP. That would mean that EVERY customer on my server would need their own IP. And with the current situation, RIPE isn't providing that much IP's for this kind of stuff.

So how you say it I wouldn't call it virtualhosting. But Ip-based hosting.

If you can show a need for the IP, then you should be able to get them.

Other than that, sounds like log parsing is the only other method.

Sorry for the mixup with words, from the original post I assumed there was the ability to account per IP.

[webx]

Ok, let me dig it further.

One thing is sure that with name-based hosting, it is inefficient and very difficult to make accurate BW usage graphs. So many logs and so many non-logs usage.

But with IP-based hosting, how would you include the usage of sendmail/qmail, FTP, file uploads thru HTTP, mails generated by scripts, and if SSH is provided: any FTP/HTTP downloads on the server itself? (wget, lynx, ftp)

My guess is everything may not be included. So this comes down to well-calculated approximation.

And this would be for resellers from one box. For big companies offering dedicated server, it's pretty easy for them to watch just one IP and bill the customer

[Starhost]

On freeBSD (for example) their are standard scripts in ipfw that calculate Bandwidth per IP. And when everybody site is running on their own IP. Then ALL bandwith generated by that host will be calculated.

So all email has to be delivered tot the same IP as the websiite is using. That isn't that hard to calculate. The only thing were is need for is calculate Bandwidth using Namebased hosting.