Experimental network statistics aggregator via NFLOG (performance research)

Goals:

1. Collect statistics to find out overall VPN traffic volume
2. Collect statistics to find out overall non-VPN traffic volume
3. Evaluate per internal IP(s) VPN-non-VPN traffic volume

Traffic sensing strategy:

1. NFLOG all from INPUT (to collect all statistics, including FROM VPN: dante, Linux local, tun itself)
2. NFLOG all from OUTPUT (to collect all statistics, including TO VPN: dante, Linux local, tun itself)
3. NFLOG FORWARD traffic with mark, which reroutes (TO 'transparent' VPN)
4. Mark packets received from tun+ to highlight as incoming from VPN (tun+)
5. NFLOG FORWARD traffic with mark from previous step (FROM 'transparent' VPN)

• Substitute src/dst packets with marks with VPN IP to summarize (minimize) data (done)
• To enrich information, NFLOG PREFIX could be used with netfilter rules (?)

Storage notes:

store pointers in map[uint64]*stat and []*stat like:

var (
statmmap[uint64]*statunitstats []*statunit
)
typestatunitstruct {
srcIPuint32dstIPuint32srcdstuint64// src->dst traffic, aka upload in Bytesdstsrcuint64// dst->src traffic, aka download in ByteslastPktRealSrcuint32// unmodified src IP addresslastPktRealDstuint32// unmodified dst IP addressinDevuint32// Linux network interface IDoutDevuint32// Linux network interface IDpktCountuint64// Number of captured packets
}

Use uint64 - 'concatinated' src and dst IPv4 addresses, (min first) as a map key

TODO:

• Improve code (globals, thread-safety - for now assumed that read op. is atomic)
• Rework traffic aggregation system
• Rework ouput format, sorting
• Save/Restore data somehow to protect from reboot (power down)
• More signals (?): add one to reset collected data