2012-04-02 - Re: [GRASE-Hotspot] Session History

Header Data

From: Tim White <ti***8@gmail.com>
Message Hash: 2e21b4ad6428f65545beddc4c921327615722f91999100c0cdfb417b39ca36a7
Message ID: <4F797B20.6040008@gmail.com>
Reply To: <CAAnGMTGj2X0sz66uu2N36t35zYfGTCz3cseTocpNWGqAsTdtgw@mail.gmail.com>
UTC Datetime: 2012-04-02 03:10:40 UTC
Raw Date: Mon, 02 Apr 2012 20:10:40 +1000

Raw message 

On 02/04/12 19:30, iii iii wrote:
> I just noticed a single weekend customer session of 220 Mb only shows 
> 6 Mb in the details per the radmin pages.
> Is this just because those pages only show www/http traffic?
> If so, how can I get a full report listing all protocols?
> (I am operating on the assumption that the missing 200+ Mb is MS 
> Windows updates.)
>
> On a related note, where in the database is the above session detail 
> stored?
> Or, if not in the db, where do I go to manually find it?

The session report will show the total amount, and the www/http traffic. 
IIRC it has the total amount in brackets? (Can't check atm).
The total amount is calculated from the radius sessions, in the radius 
radacct table. The www/http amount is calculated from the Squid logs.
The only way to get a full listing of protocols, is some pretty 
complicated traffic accounting setups, which I have investigated and the 
system resources it consumes is just not worth it. If you are interested 
in it, look around for linux traffic accounting packages, there are a 
few around (although the simpliest may just be some firewall rules to 
categorise some of the traffic into protocols, and lump the rest into a 
single rule).

Sorry I can't help you more. IIRC Windows updates used to be over http, 
but that may have changed. Things like bittorrent can be seen very 
obviously sometimes when a user has a few Gb's downloaded and no web 
traffic! Maybe your customer is using a VPN? Companies often force the 
use of a VPN.

Tim

Thread