Network traffic monitor

Lzolcsi · 04-25-2007, 12:52 PM

Hi,

I got a debian box with shorewall sharing an ADSL connection on my LAN.
Sometimes internet gets really slow, and I think it is beacuse one of the users is using bitorrent without limiting the upload speed.
Do you know a tool for monitoring network traffic, so I can see the number of packets received from each pc on the lan, and the used bandwith, also per pc.

Thank you.

acid_kewpie · 04-25-2007, 01:23 PM

i'd suggest using tcptrack there, as that little widget, which took me ages to find, gives you live details of active tcp sessions and their bandwidths, so you can instantly see who's actually hainv gwhat effect, albeit at a basic level.

lhrt · 04-26-2007, 01:43 AM

Ntop or bandwidthd will also work.

Lzolcsi · 04-26-2007, 02:04 AM

Thanks for the help, I'll try these programs.

Lzolcsi · 04-27-2007, 12:19 PM

tcptrack was really useful. There were about 5 entries for all the machines toghether, except one, that has 20+. Now I'm sure it is torrent.

Thanks a lot

systemnotes · 04-27-2007, 03:37 PM

I really like MRTG (Multi Router Traffic Grapher)
http://freshmeat.net/projects/mrtg/

http://oss.oetiker.ch/mrtg/

Once you set it up, it produces some nice HTML output. It uses SNMP to talk to your routers. It's the kind of tool you leave running, and then check on the output every once in a while. When you see unusual spikes, you can investigate further.

acid_kewpie · 04-27-2007, 04:19 PM

yes but snmp isn't going to show you who's connected to what at any given time, jsut a total throughput of a single node. assuming that the router even supports snmp, it'll only single one reasonably useless result in this instance.

systemnotes · 04-28-2007, 12:43 AM

Quote:

Originally Posted by acid_kewpie

yes but snmp isn't going to show you who's connected to what at any given time, jsut a total throughput of a single node. assuming that the router even supports snmp, it'll only single one reasonably useless result in this instance.

Yes, I realize I didn't answer the question. This is just another good tool to keep running, and then when you see a spike, you can use other tools, such as tcptrack, tcpdump, or snort to analyze the traffic. They are all different tools for different purposes.

tanveer · 05-04-2007, 04:39 AM

Hi all,
I have a similar situation here. Some users giving heavy downloads thourgh my proxy server and I want to track them down.
Is it possible thorugh tcptrack as a good amount of users are using that proxy.

libyalinux · 05-07-2007, 08:23 AM

as lhrt say Ntop i use this tools 2 monitor about 200 node and it's working great

M.Ayad