network traffic monitoring tool suggestions

noir911 · 01-13-2007, 09:39 AM

I'm after a tool which would graph traffic and keep historical information. For example, I want to see the aggregate outbound traffic to port 80 from 10.x.x.x netblock on November 2006 and which IP address is the highest consumer of that traffic. Does anyone know of any tools that would give that kind of information?

I'm currently using cacti, nagios and ntop and also had a look at bandwidthd and argus. Any suggestion would be helpful.

MensaWater · 01-13-2007, 09:59 AM

tcpdump/ethereal (the latter being graphical) willl give you packet information.

Snort is for network monitoring. Our Network security guy uses that so I don't really know the details of what it is capable of. He was also looking at something called Snortsam which manipulates the data.

There may be better tools and I don't know if either of the above allow for bandwidth measurement but figured I'd mention them for something to explore.

btmiller · 01-13-2007, 02:55 PM

I use bandwidthd with a back-end PostgreSQL database on my home network and like it a lot. I've never really liked ntop for a variety of reasons. If this is for work and you can persuade your employer to spend some $$$ there are a number of commercial tools too.