How to separate traffic accounting?

Question

linux

Welcome all.
The bottom line is this: I consider traff vnstat'om, but he considers everything ! Is there a program that would only consider the Internet and not look at the local area? That is, it would count at all addresses except for the range, for example 192.168.0.0/24.

Answer 1

If both the sender of the packet has a mask of 192.168.xx and the recipient too, then this is a packet on the local network, if only one of them, then this is a packet over the Internet, you need a filter, and you can also filter by ports, I use Wireshark, in it and both exist.

Answer 2

ntop, ipt_netflow + ntop|scripts.