No, this ain't a 'packet sniffer' if that's what you are thinking. Common packet sniffers like sniffit simply "sample" any IP packets that happen to be in linux's internal buffers.
iptrk was first designed to detect hackers attacking our equipment here at Arafura Connect. it's initial specification was to detect abnormal types of traffic on our networks... but now days, it's been expanded to do volume accounting (for site hosting- so we know how much to charge a customer whose machine we host), and also to determine if certain machines have crashed etc (detect if a machine is not sending data).. and email the SYSOP (who happens to be me ;) if anything abnormal has happened etc. iptrk is currently used for our radio LAN we operate here in Darwin as well (which has the same mechanics as site hosting).
Unlike packet "sniffers", iptrk tracks *every* *single* packet that hits the network interface. In order for this to happen, I had to do a kernel hack- that is, I had to add a facility so that the kernel would now buffer IP information into a special queue**. A user space program (viewed in the screen shots) would pull this IP information off the queue via a character device (/dev/iptrk) and then do it's monitoring/recording.
Following are screen shots of the user space process that monitors and logs packet information it pulls off my hacked queue (in the kernel). The immediate information you can see in the botton part of the screen shots is updated every second producing BPS (bytes per second) amounts. These are further broken down into in/out/internal/martian volumes, and what type of services they are. The first screen shot shows you the program in streaming mode- it simply displays IP packet info as they hit the network interface (above).
The following shows you sorted lists of IP numbers in our networks (networks that belong to us)-
They are sorted by traffic they receive/send. The above screen shot for example shows you a list of top receivers. The volumes in these lists are broken down further into Total, UDP, TCP and OTHER. These two screens are invaluable for us, because when we get a phone call from a customer informing us why something is slow or not working, we can instantly see at a glance what machines are being hit the most (and who is doing it ;).
The next screens are the web interface, which provides reporting, detection of attacks, and information to do billing-
The following screens are the graphing facility. They will produce address domain histograms. When iptrk emails you telling you somebody is hammering the network, or that your network is getting DOSA'ed, then you can jump in here and see at a glance who has been hammered (this is iptrk's most powerfulest facility and one that is used most by us)-
Here is the "time domain" graphing facility.
Iptrk was developed (and is designed for) linux 2.4. It has been written in C, with a web & ncurses frontend.