[routing-wg] Asking methods to monitor used IPs

On 11/5/13 13:07 , Leonardo Arena wrote:
> Il giorno lun, 04/11/2013 alle 23.06 +0330, Jahangir Asadi ha scritto:
>> Dear Sir or Madam
>>
>>
>>
>>      I have some customers who I have allocated high band width with
>> wide ranges of IPv4 addresses to. Because of lack of IPv4, I would
>> like to see that how many IPs they are using. It would be grateful if
>> you  tell me how can I do this and what soft ware I have to use to
>> monitor the used IPs.
>>
>>
>>      I would like to thank you in advance and I am looking forward to
>> hearing from you soon.
>>
>>
>
> Hi,
> what you might want to do is a ping sweep. However it is effective only
> against hosts that allow ICMP echos. For those customers that block ICMP
> I think your only option is a port scan, which might not be desirable.
>
> For both ways your best choice is nmap [1].
>
> BR,
>
> leonardo
>
> [1] http://nmap.org/

Those are active scans, and some host legitimately do not respond to any 
ports, that doesn't mean they are not using legitimately using 
addresses.  Passive traffic monitoring is the only true way to answer 
the question asked, such as netflow, sflow, or with a passive traffic 
taps.  However, passive or active, there are likely political 
consequences to such activities.  You should really think about what 
your policies are in regards to what data you are going to collect 
before doing such a thing, and probably consider the implications for 
your customer privacy policy.

YMMV.

-- 
================================================
David Farmer               Email: farmer at umn.edu
Office of Information Technology
University of Minnesota
2218 University Ave SE     Phone: 1-612-626-0815
Minneapolis, MN 55414-3029  Cell: 1-612-812-9952
================================================