On Sun, 26 Feb 2012 14:31:29 -0600 Les Mikesell wrote:
Without separate interfaces there's not much to distinguish your local/external concepts.
As I see it, there's probably some way (that I haven't yet discovered) to separate the traffic by gateway. Or at least some way to distinguish local traffic from external traffic.
Did you try ntop? It basically acts as a packet sniffer that can group and summarize by a lot of different categories but there is a lot of overhead in building the database with all that info.
I'll look at it.