Monitoring BW usage 1

[McDouglas]

Hi,


How can I monitor who is using the internet in a given time?

I know I can install a netflow monitor, but that will only generate me graphs for daily, monthly, hourly usage.

I need something like the linux iftop utility:

http://www.ex-parrot.com/~pdw/iftop/iftop_normal.png

Sometimes internet connection is really slow, and I have to figure out who is using it. I'd like to check who is using the net when I'm experiencing slowdowns.

 

[DallasBPF]

actually... netflow apps will give you info in real time, its just that you can do reports daily, monthly, and hourly usage... check out;

http://manageengine.adventnet.com/products/netflow/index.html

installed and REALLY liked having to see who was doing what over our WAN links...

------------------------------------
Dallas, Texas
Telecommunications Tech
CCVP, CCNA, Net+

CCNP in the works

 

[Minue]

Hello
You can do it all on the Cisco router with NBAR,only problem no fancy graphics.It will tell you what kind of traffic is passing throw the network and how much.ex HTTP,FTP,RTP,EMULE,BITTORRENT,etc.Cisco also offer "Ip accounting" which is cool as well.
At the application level we have Websense,which works like the a Spy,it see's everthing you user are doing.
Regards

 

[unclerico]

Minue,

Sorry for hijacking the thread here, but what are your opinions of Websense?? We're looking at putting it in play here pretty soon and I guess there's no substitute for real people really using the product. What version are you using and if you don't mind what kind of money did you throw at it?? Any gatcha's that you've come across?? Is response time pretty good overall?? Do you use it across multiple locations?? Sorry for all the questions ...thanks.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[Minue]

Hello
We're talking big bucks,per user licensing.I have never implemented the program in a production network.I had it for testing purpose only.As far a speed goes it ok,because it's really a packet sniffer,it must see all traffic going throw the network to work properly.So implementing it across multiple location could get tricky.
Regards

 

[McDouglas]

I already use Netflow Analyzer, but that's no good for real time statistics.

I need something like the linux utility 'iftop', which looks like this:

http://mcdouglas.dyndns.org/2009-02-12_1530.swf

The router has NBAR installed, but knowing what the traffic is not that important, I need to know which workstation uses bandwidth when the slowdown happens.

 

[unclerico]

Have you heard of Fluke Networks?? Take a look at their products, but be ready to spend huge dollars.

Minue, thanks for the feedback on WebSense.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[lerdalt]

A really really not-recommended solution, could be to setup a wireshark or tcpdump machine to monitor the uplink and save everything to a file. Not exactly real-time, but would get you the information.

Something using netflow is what you want. I had setup nflowd for a while and was using it to get quick reports, but there are definitely better tools out ther.

 

[Minue]

Hello
You have forgotten about cisco "ip accounting"It's not that pretty but it's close to what you're looking for.Below is on output with ip accounting turn on.

FTOINTERNET#show ip accounting
Source Destination Packets Bytes
213.156.32.111 192.168.1.107 2732 4072287
213.140.4.112 192.168.1.109 66 83526
195.210.87.2 192.168.1.110 5 331

Regards