On Sun, 26 Feb 2012 14:31:29 -0600 Les Mikesell wrote: > Without separate interfaces there's not much to distinguish your > local/external concepts. As I see it, there's probably some way (that I haven't yet discovered) to separate the traffic by gateway. Or at least some way to distinguish local traffic from external traffic. > Did you try ntop? It basically acts as a > packet sniffer that can group and summarize by a lot of different > categories but there is a lot of overhead in building the database > with all that info. I'll look at it. -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com www.creekfm.com - FIFTY THOUSAND WATTS of POW WOW POWER!