You know those moments where your own ignorance amazes you? That just happened to me. Of course, you’re right. I don’t care about individual packets, I care about logging connections. If I can show connections by each user coupled with some metadata like port numbers and dst IP address, then I will be able to investigate any complaints.

That may just have reduced the requirements of the rsyslog server, enough for shaving 30 or 50% off the cost of that machine.

Oh, but the old cisco stuff isn’t leaving the premises. We’re only pulling it from active duty so to speak. It’ll go back into the lab equipment pool. And the other stuff is staying as well. I mean the 2950 switch and 1800 series routers are fine for our labs - it’s basic configuration, we don’t even do VLANs at this level. And the 2950 will even slap the students with a ruler if they mess up their cable types, as it doesn’t support automdix.

Rsyslog actually seems to be just the thing. I’ll just find some suitable hardware for a silent mySQL server, connect it directly to the router, and have the router throw select metadata at the server. That could work.

I hope someone has an idea about how much storage I’ll need. If I had to back of the envelope this calculation, then this is my thought process. If the students are going full throttle on the 1gig connection, then they’re pulling 125MB each second, if that’s all 1518B frames, then I need to store 82400 data points each second and if it’s 64B frames then just short of 2 million. Hopefully it will be large frames mostly. But let’s assume a mix and 100k packets will need to exit the network each second for 6 hours each day. That’s 8.64x10^9 data points each day. The students are there 5 days a week and then it’s 43.2x10^9 data points. Assuming no compression and juat a 32bit time field, src and dst IPv4 address and ports, that’s 128bit per data point or 644GB each week. I’ll probably want to be able to go back a month at least. So I’ll need 3 TB fast storage, 32GB RAM, maybe 128GB because then writes at peak usage can be cached, and 4 or 8 CPU cores, in a silent package. This is starting to sound like the most expensive part by far.