How to measure Bandwidth Used


My ISP claims we used 32 Gigabytes last month. How can I confirm this?

Use the builtin ipcop utility ipacsum

There is a built-in function on IPCop that will tell you total bytes in out and through your IPCop box. IPCop keeps track of total bytes in and out of each interface and uses it to generate the graphs. You can query the database manually from the command line by logging in as root using putty or by hooking up a monitor and keyboard to ipcop.

The comand to type is ipacsum, you need to pass it the start time and endtime (-s and -e), or if you don't specify endtime, it gives everything till now since the starttime. Times are year, month, and day all run together, and you can also include hours,minutes and seconds if you want. Examples are easier than explanations.

I want to see how much traffic passed through my ISP between 2008, Feb 1 midnight and March 1st Midnight, in megabytes. On IPCop type:
ipacsum -s 20080201 -e 20080301 --fixed-quantity M

Host: ipcop.jaars.org / Time created: 2008/03/18 09:31:39 EDT
Data from 2008/01/31 23:00:00 EDT to 2008/02/29 22:59:59 EDT
 forwarded incoming GREEN (eth0) : 32M
 forwarded incoming RED (eth1) : 2M
 forwarded outgoing GREEN (eth0) : 4M
 forwarded outgoing RED (eth1) : 1M
 incoming GREEN (eth0) : 75M
 incoming RED (eth1) : 160M
 outgoing GREEN (eth0) : 181M outgoing RED (eth1) : 49M

The summary that IPCop gives is from IPCop's perspective; incoming means it's heading towards IPCop from the mentioned colored network.
Now you need to do some math. Add all the lines for "RED" and this is what your ISP sees as your total traffic.

"incoming" and "outgoing" traffic is traffic that starts or stops from the IPCop box. This is mainly web proxy traffic (squid/dansguardian) and DNS lookups from dnsmasq. Incoming GREEN should generally correspond to outgoing RED. However, things cached by Squid or update accelerator will make the GREEN numbers bigger than the RED numbers. In addition GREEN incoming and outgoing traffic will include you, the administrator, looking at IPCop's web interface and log files, copying addons to ipcop etc.

"forwarded incoming" and "forwarded outgoing" is all the other traffic that passes through IPCop on other ports besides 80 (http) and 53 (DNS). This will include email, chat, voip (skype etc.) and various other stuff. I would expect on a simple IPCop setup for the forwarded incoming GREEN to closely match the forwarded outgoing RED. This isn't the case in the above example, and I'm guessing that's because we've got a VPN tunnel which is messing up the numbers. I don't really know.

Other examples:
If I want everything in the last 24 hours (1 day):
ipacsum -s 1D

or the past 2 hours:
ipacsum -s 2h

or the past 5 minutes in exact bytes:
ipacsum -s 5m --fixed-quantity ''
(That's two single quotes at the end)

Between 8AM and 8:30 today (March 18, 2008)
ipacsum -s 200803180800 -e 200803180830

Since the beginning of the month (March 1st) in Megabytes and show only RED traffic:
ipacsum -s 20080301 --fixed-quantity M | grep RED

There is an addon for the Web GUI

For a summary of traffic in and out of each IPCop interface in the GUI, there is an addon.
I haven't tested it, but I know the author writes good stuff. You can get it and instructions here:http://blockouttraffic.de/nt_index.php