I'd think an IPfilter pass/log rule would be less effort.
--
Brandon Hume - hume -> BOFH.Ca, http://WWW.BOFH.Ca/
If you want to get exact data then using IP QoS and the flowacct module
would be the solution. See "man -s7ipp flowacct" (and the more general
manpages on ipqos and ipqosconf).
Bye,
Wolfgang.