Looking to graph ingress & egress bytes on firewall ints with MRTG

Question

I have an install of MRTG that I put together some years ago which graphs bandwidth use on our PAN firewalls' outside interfaces. It runs as a service on our Windows management box, and the results are displayed in an IIS site on that same box.

Recently, we've been told that in order to detect irregularities or possible exfiltration of data, it would be a good idea to do a similar thing based on the amount of data (bytecount) egressing and ingressing those same firewall interfaces, perhaps using ifHCInOctets & ifHCOutOctets? I've Googled and Googled and not really found much that would be of use to someone with limited MRTG skills like myself. The most promising post I've found is this one:

https://marc.info/?l=mrtg&m=126376490605781&w=2

Which talks about getting daily graphs of traffic. Since I'm already collecting data from these interfaces to display bandwidth, is there a way to leverage that existing data or infrastructure to make a graph of this type? Could it use the same installation of Perl & MRTG to do that? Can anyone suggest anything or any resources I might look at to get me started? Thanks for your time!

Edited to included a crap little paint pic to demonstrate what I envisioned:Traffic Graph

Answer 1

Your existing MRTG is collecting and graphing the Incoming and Outgoing throughput, in bytes (or bits) per second, and your graphs are showing this averaged up over progressively larger time windows as you move from Daily through Weekly to Yearly.

What you're asing for is a way to identify the difference between the total inbound and outbound traffic; the example you link does this at a Daily level. So, you're really interested in seeing the total in 1-day increments of (inbound-outbound), or to put it another way,

86400 * ( avg[1day](inbound) - avg[1day](outbound) )

The MRTG Yearly graph already averages the per-second rates of Inbound and Outbound to a 1-day granularity, but you need to get the difference and multiply it up by the number of seconds in a day (86400) to get the daily total difference.

To do this in MRTG, you will need to

• Define a new Target that is defined as (incomingcount-outgoingcount)
• Suppress Daily and Weekly graphs for this
• Set an 86400 multiplier
• Update the labels and so on so that they make sense

Note that this will mean you don't have historical data (its a new Target rather than a new way to display the existing Target data) but that may not be a bit problem. If you're using the Routers2 frontend then there are other ways to achieve this using the existing Targets but we'll stick with plain MRTG for now.

In MRTG, you will need to define a new Target similar to this:

Target[xxxx]: ifHCInOctets.1&PseudoZero:community@router - ifHCOutOctets.1&PseudoZero:community@router
Factor[xxxx]: 86400
Title[xxxx]: Net traffic difference per day
Suppress[xxxx]: dwm
YLegend[xxxx]: bytes/day
ShortLegend[xxxx]: /d
Options[xxxx]: noo nopeak
Legend1[xxxx]: Traffic difference
LegendI[xxxx]: Net

In this case, the database will hold the average traffic difference per second for interface 1; the graph will show this for Yearly only, multiplied by 86400 to show the total for the Day (suppressing the second value and the peak lines, as they are meaningless).

There's another important point to remember here as well. Since outbound rate may be temporarily higher than inbound (unlikely, but possible) you might get negative values. These cannot be stored in vanilla MRTG and so you would have to have RRDTool as your backend, and be configured to allow negatives, otherwise you'll just see 'unknown's - and the totals graphed would be incorrect.