Cisco routers and Local vs International throughput

I am starting this thread because I want to research what it will take to record local and international throughput using Cisco routers. The aim is to make dead sure we're not missing something that would make our ISP's lives a lot easier by enabling them to bill us for local and international usage separately.

Basic information required:
This originating IP Address sent/received x bytes from/to that final IP Address.

Now, from what I have researched so far, it seems there are 2 ways to do this:

Monitor a copy of all the traffic going through each switch [SPAN]:

Source: http://www.cisco.com/warp/public/473/41.html#support

Hardware: A whole bunch of catalyst series switches. List is in the URL above.

This involves wasting one port on each switch, that port gets a copy of all traffic passing through the switch via the SPAN command, you then install a computer onto that one port that analyzes all the traffic moving through the switch and record the information that you need to record.

Conclusion:
This method can/will slow down a very busy switch and the cost of adding a machine to monitor and record the traffic is unwanted. And .. exactly how many switches are we talking about here? Are they right next to each other, so that one machine can record all the traffic by having one network card per switch? [need ISP response]

Use the router's IP Accounting Facilities [ip accounting]:

Source: http://www.cisco.com/en/US/docs/ios/11_1/feature/guide/macacct.html
More: http://www.informit.com/articles/article.aspx?p=764234&rl=1
Table of Options: http://www.informit.com/articles/article.aspx?p=764234&seqNum=5
Scripts to gather Recorded info: http://www.net-sense.com/faqs.htm

Hardware: The second url says all except for Cisco 12000, and there is a problem with Catalyst 6500/7600.

This involves configuring the routers to record bytes sent and received, and then retrieving the records from the routers. This would seem to be the logical approach to performing what needs to be done.

Problem is that there is a maximum size to the information that can be stored on each router (512), and, you have to get the information off the router before it gets truncated by the router, and then process it somewhere. The articles talk about 512 entries in the recording tables, where at the ISP we need like 500 000 entries in the recording tables.

I am also not sure what IP Address and Mac Address is available here, is it the previous router's Mac/IP address, or is it the original source and final destination's Mac/IP address?

Conclusion:
In short, this solution is only available for switches near the client (us), where the data traveling through the switch is for a select number of users.

Others:
I'll edit and add other ideas here.

EEEK, I am drowning, but not trying tastes kind of bland.

SAIX already does this...

As part of Telkom SA Internet Service (SAIX) implementations all international traffic entering the network, for our international peering partners, is marked with an IP Precedence value of 2, while all national traffic is marked with a IP precedence of 0. This gives Telkom SA Clients the ability to distinguish and measure between International and national traffic. It must be noted that the international traffic is no ways prioritized and is queued with national traffic in the Telkom SA IP network.

Note: International Peering is defined as peering partner connections to The Telkom SA routers located in London, New York, Ashburn, Amsterdam and Hong Kong.

Click to expand...

How to use example on Cisco IOS

The problem is that from the hundred's of thousands of active sessions, is to determine who's traffic belongs to who - in real time, and THAT is where the problem comes in.... You're taking about billions of packets per second that needs to be inspected in real time, and tied in real time to a username. Unlike certain people here believe, it's NOT as simple as just determining what is local and what is international...

First .. I TRIPPLE curse the moron who assigned BACKSPACE to BROWSE BACK in firefox. AAAARG! MORON!
Phew. Rant over. Feel better. Begin re-typing.

Thank you savage(Chris) for your post.

Please "hear" my understanding of what you have posted ...

If I understand correctly, all traffic enterting the SAIX network at ANY border point is flagged precedence2 for:
- traffic destined for SAIX's international partners
- traffic entering the network from SAIX's international partners
This means that ISP's can gather Accounting information from their switches using the precedence only, and do not have to maintain long lists of Local IP Address ranges.
Nice.

This is probably the Accounting information that SAIX wholesale use to charge the ISP's for their throughput, differing on the local and international throughput.

Now, does this Accounting information include the client's IP Address? I think that it does.

But, then there is the problem of users starting a session, and then ending a session, and the IP Address of that user being re-assigned to another person who logs on.

Now the Accounting information being gathered at the ISP does not know about the user swap, and therefore billing inaccuracies can set in. This is unacceptable.

Am I right so far? If so, then:

Am I correct in saying that if each ADSL user was assigned a fixed ip address instead of a floating IP Address, the problem of determining who is using which traffic is eased quite considerably?

Of course, this is assuming that the implementation of a system that records Accounting information is a cost effective option to an ISP, which I doubt it is.

teenskie weenskie littly tiny winy bump