Re: opposite direction traffic

[research@mclachlan.com.au]

I've installed iptraf on a server. I am using it in the background and I
would like to clarify what is recorded in the ip_traffic log files.

In particular. Is the number of bytes listed against "opposite direction"
traffic actually recorded elsewhere in the log file ?

i.e. Initially I wasn't calculating usage from the opposite direction. Then
I felt that it was required to accurately capture ALL traffic. HOWEVER in
the case below the 147931549 is clearly captured twice. Is this always the
case ? Are there times when the opposite direction traffic won't be recorded
elsewhere as in the example below ?

From the two lines below, can you tell me which "Bytes" portions represent
new and unique traffic ?

Tue Jun 3 15:18:17 2003; TCP; eth0; 40 bytes; from 213.199.146.24:80 to
192.168.1.12:2867; FIN sent; 98639 packets, 147931549 bytes, avg flow rate
0.00 kbytes/s

Tue Jun 3 15:30:00 2003; TCP; eth0; 46 bytes; from 192.168.1.12:2867 to
213.199.146.24:80; Connection reset; 55420 packets, 2562424 bytes, avg flow
rate 0.00 kbytes/s; opposite direction 98639 packets, 147931549 bytes; avg
flow rate 0.00 kbytes/s

Thanks,

Wilson Fletcher