Не претендую на новизну. Но потратив некоторое время на поиски чего-нибудь простого и подходящего мне, к сожалению, как всегда пришел к выводу читайте man и howto и пользуйтесь /dev/hands.
Если честно то периодически лень берет верх

Используется только IPTABLES и bash.
Конфигурация:
RH 8.0 - Server/Firewall and etc
eth0 - смотрит наружу IP: 192.168.0.10
eth1- смотрит в мою local'ку IP: 10.0.0.1
В local'ке две машины Workstation and Laptop, иногда брат приезжает с третьей машиной, будем называть его OTHER.
За основу взяты некоторые scripts публично доступные.

1. Нужно считать трафик TCP как INBOUND так и OUTBOUND.
   
2. Трафик с провайдерской сеткой.
   
3. Траффик с интернетом.
   
4. Ну и конечно сколько жрет внешнего трафика каждая машина.
   

#!/bin/sh
#
#    traflog - logger of iptable's statistic
#
# Path to your system iptables
IPTABLES="/sbin/iptables"
# Path to dir with log output
F_PATH="/var/log/firewall/traflog"
#
# Files have names like 'YearMonthDate . whose trafic
F_LNET="$F_PATH/"`date +"%Y%m%d"`".lnet"
F_SERV="$F_PATH/"`date +"%Y%m%d"`".serv"
F_OVER="$F_PATH/"`date +"%Y%m%d"`".over"
F_ALL="$F_PATH/"`date +"%Y%m%d"`".all"

LAPTOP_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_LAPTOP -v -x -n | grep RETURN | head -c 18 | tail -c 9`
WS_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_WS -v -x -n | grep RETURN | head -c 18 | tail -c 9`
LNET_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_LNET -v -x -n | grep RETURN | head -c 18 | tail -c 9`
LNET_ISP_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_FRWD -v -x -n | grep TRAFFIC_TCP_INBOUND_ISP | head -c 18 | tail -c 9`
LNET_EXT_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_FRWD -v -x -n | grep TRAFFIC_TCP_INBOUND_EXT | head -c 18 | tail -c 9`

LAPTOP_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_LAPTOP -v -x -n | grep RETURN | head -c 18 | tail -c 9`
WS_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_WS -v -x -n | grep RETURN | head -c 18 | tail -c 9`
LNET_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_LNET -v -x -n | grep RETURN | head -c 18 | tail -c 9`
LNET_ISP_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_FRWD -v -x -n | grep TRAFFIC_TCP_OUTBOUND_ISP | head -c 18 | tail -c 9`
LNET_EXT_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_FRWD -v -x -n | grep TRAFFIC_TCP_OUTBOUND_EXT | head -c 18 | tail -c 9`

SERVER_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND_SERVER -v -x -n | grep RETURN | head -c 18 | tail -c 9`
SERVER_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND_SERVER -v -x -n | grep RETURN | head -c 18 | tail -c 9`
SERVER_ISP_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND -v -x -n | grep TRAFFIC_TCP_INBOUND_ISP | head -c 18 | tail -c 9`
SERVER_ISP_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND -v -x -n | grep TRAFFIC_TCP_OUTBOUND_ISP | head -c 18 | tail -c 9`
SERVER_EXT_IN=`$IPTABLES -L TRAFFIC_TCP_INBOUND -v -x -n | grep TRAFFIC_TCP_INBOUND_EXT | head -c 18 | tail -c 9`
SERVER_EXT_OUT=`$IPTABLES -L TRAFFIC_TCP_OUTBOUND -v -x -n | grep TRAFFIC_TCP_OUTBOUND_EXT | head -c 18 | tail -c 9`

SERVER_OVR_IN=`expr $SERVER_EXT_IN + $SERVER_ISP_IN`
SERVER_OVR_OUT=`expr $SERVER_EXT_OUT + $SERVER_ISP_OUT`

OVR_ISP_IN=`expr $LNET_ISP_IN + $SERVER_ISP_IN`
OVR_ISP_OUT=`expr $LNET_ISP_OUT + $SERVER_ISP_OUT`
OVR_EXT_IN=`expr $LNET_EXT_IN + $SERVER_EXT_IN`
OVR_EXT_OUT=`expr $LNET_EXT_OUT + $SERVER_EXT_OUT`

OVR_IN=`expr $SERVER_OVR_IN + $LNET_IN`
OVR_OUT=`expr $SERVER_OVR_OUT + $LNET_OUT`
OVERALL=`expr $OVR_IN + $OVR_OUT`

############################################################ #####
#			Here is output for local network	#
############################################################ #####
localtraf() {
    echo "" >> $F_LNET
    echo `date +"%d/%m/%Y  %T"`"	TRAFFIC FOR LOCAL NET" >> $F_LNET
    echo "Input		Output			Description" >> $F_LNET
    echo "$LAPTOP_IN	$LAPTOP_OUT		Laptop" >> $F_LNET
    echo "$WS_IN	$WS_OUT		Workstation:" >> $F_LNET
    echo "$LNET_ISP_IN	$LNET_ISP_OUT		Local Network to TSP" >> $F_LNET
    echo "$LNET_EXT_IN	$LNET_EXT_OUT		Local Network to Internet" >> $F_LNET
    echo "------------------------------------------------------ --------------" >> $F_LNET
    echo "$LNET_IN	$LNET_OUT		Overall for Local Network" >> $F_LNET
}
############################################################ #####
#			Here is output for Server		#
############################################################ #####
servertraf() {
    echo "" >> $F_SERV
    echo `date +"%d/%m/%Y  %T"`"	TRAFFIC FOR SERVER" >> $F_SERV
    echo "Input		Output			Description" >> $F_SERV
    echo "$SERVER_IN	$SERVER_OUT		Server" >> $F_SERV
    echo "$SERVER_ISP_IN	$SERVER_ISP_OUT		Server to ISP" >> $F_SERV
    echo "$SERVER_EXT_IN	$SERVER_EXT_OUT		Server to Internet" >> $F_SERV
    echo "------------------------------------------------------ --------------" >> $F_SERV
    echo "$SERVER_OVR_IN		$SERVER_OVR_OUT			Overall for Server" >> $F_SERV
}
############################################################ #####
#			Here is output for Overall		#
############################################################ #####
overalltraf() {

    echo "" >> $F_OVER
    echo `date +"%d/%m/%Y  %T"`"	OVERALL TRAFFIC FOR:    "`hostname` >> $F_OVER
    echo "Input		Output			Description" >> $F_OVER
    echo "$LNET_IN	$LNET_OUT		LOCAL NETWORK" >> $F_OVER
    echo "$SERVER_OVR_IN		$SERVER_OVR_OUT			SERVER" >> $F_OVER
    echo "$OVR_ISP_IN		$OVR_ISP_OUT			With ISP" >> $F_OVER
    echo "$OVR_EXT_IN		$OVR_EXT_OUT			Internet" >> $F_OVER
    echo "------------------------------------------------------ --------------" >> $F_OVER
    echo "$OVR_IN		$OVR_OUT			TOTALL" >> $F_OVER
}
############################################################ #####
#			Here is short output for Overall	#
############################################################ #####
shorttraf() {

    echo `date +"%d/%m/%Y  %T"`"	INBOUND: $OVR_IN	OUTBOUND: $OVR_OUT" >> $F_ALL
}
resettraf() {
    $IPTABLES -Z
}

case "$1" in

    -b)
	if [ "$2" = "-p" ]; then
		F_ALL="/dev/stdout"
	fi
	shorttraf
	if [ "$2" = "-r" ]; then
		resettraf
	fi
	RETVAL=0
	;;
    -o)
    	if [ "$2" = "-p" ]; then
		F_OVER="/dev/stdout"
	fi
	overalltraf 
	if [ "$2" = "-r" ]; then
		resettraf
	fi
	RETVAL=0
	;;
    -l)
    	if [ "$2" = "-p" ]; then
		F_LNET="/dev/stdout"
	fi
	localtraf
	if [ "$2" = "-r" ]; then
		resettraf
	fi
	RETVAL=0
	;;
    -s)
    	if [ "$2" = "-p" ]; then
		F_SERV="/dev/stdout"
	fi
	servertraf 
	if [ "$2" = "-r" ]; then
		resettraf
	fi
	RETVAL=0
	;;
    -a)
    	if [ "$2" = "-p" ]; then
		F_ALL="/dev/stdout"
		F_LNET="/dev/stdout"
		F_SERV="/dev/stdout"
		F_OVER="/dev/stdout"
	fi
	localtraf
	servertraf
	overalltraf
	shorttraf
	if [ "$2" = "-r" ]; then
		resettraf
	fi
	RETVAL=0
	;;
    *)
	echo $"usage: traflog [-bolsa] [-pr]"
	echo $"	-b		log Overall traffic statistic in brif"
	echo $"	-o		log only Overall statistic"
	echo $"	-l		log internet traffic for local network"
	echo $"	-s		log internet traffic for server"
	echo $"	-a		log internet traffic for All"
	echo $"	-r		reset statistic in ALL chains of iptables"
	echo $"	-p		display statistic information only on /dev/stdout"
	echo $""
	echo $"	log path: 	$FILE"
	exit 1
esac
exit $RETVAL

Опубликовал: Sergo
Дата: 30.07.2003
постоянный адрес статьи: http://linuxportal.ru/entry.php/P84_0_3_0/