Traffic analysis

[Jammer <jammer_(_at_)_flashmail_(_dot_)_com>]

Hi

Can anyone recommend a good traffic analysis package for my OpenBSD firewall 
that works with pf. I'd like to get a rough breakdown of the incoming and 
outgoing traffic based on its type.

I've recently noticed a huge increase in my monthly traffic and would like to 
get a handle on exactly where it is coming from/going to. (I've livened up an 
email server behind the firewall and wonder if SPAM is the culprit.)

I've had spamd running in simple blacklist mode (I've just enabled greylisting 
today) and I'm also running a couple of web-servers. I'd like something that 
can give me a more detailed analysis/report of incoming and outgoing packets 
and indicate whether it is email, web or ftp, incoming or outgoing that is 
sucking up the bandwidth.

Note: I don't want to analyse my Web-server traffic as I have plenty of tools 
that will do that for me. I'm after something that will give me a view of the 
bigger picture, probably by analysing pflog data (and something a bit more 
than just tcpdump.)

Any advice or suggestions would be greatly appreciated. Cheers

Jeremy