I'd like to install one on our small ADSL connected office LAN so I can pinpoint trouble spots (e.g. where some monkey has gone out to lunch but decided to download half a dozen movie trailers beforehand). Found a good list of network monitoring tools for linux here but most seemed to manage traffic to and from the host running the software.

I need to be able to track individual IP's on our subnet and the traffic they are putting through our gateway router (another network device, not running on the same machine as the monitoring tool).

Any recommendations?

depends what the router is... if it supports cisco netflow, sflow, ipfix etc.. then you could make it report statistics to the monitor on a tool like ntop. standard things like snmp don't provide host specific data, just volume of data through a point. you could set up snmp on all hosts and monitor that, but that will be ALL traffic in and out of each box, not just internet traffic.

Some managed switches will do this. So you might want to look into your switch and what it's capabilities are. Could also use wireshark.

ntop would probably be the choice I would make..

mrtg polling your switch via snmp could show you the bandwidth per switch port, but it wouldn't break it down in any fashion where you would be able to tell if it's legitimate traffic or not. nor would it tell you who (what IP) was connected to which port..

Run iptraf.

Its a great utility to do exactly this.

You can view the logfile to get the statistics you need. In particular which ip's send the most traffic.

Theres a lot of nifty rules you can setup in iptables to manage connections like this, for example you can add rules to quota the amount of bandwidth provided per subnet or per IP.

If you want to go a few steps further you can setup traffic control and deliberately slow down connections from IP's on your network that hit their quota.

I.E quota = 1GB, if you go higher your packets are classified in such a way that you get a 128Kbit connection for the remainder of the day.

Thanks for your replies, I'll look into these. Thanks also for the traffic control tips Deleriux - I'm hoping to avoid having to go that far and the size of our LAN/pipe only makes this an occasional problem.