Hi,

I'm trying to find a solution for this problem. I have a firewall that has 2 links on it, and it's a gateway for my local network. It's working well, but I need monitoring it, for the main reason "I can't block any access all the time" but I can use priority and did it, but if a host trying to access a video, download etc I wan't to know witch host doing it and witch sites he's trying to access at this moment. I tried zabbix, installed it, but just got graphics for interface, zabbix don't show me witch hosts are generating that bandwidth, and I need know it to block that host for a short moment if I have to many hosts trying access a site that's important for the job and 1 or more hosts are trying to access a site that's not important. I tried squirm, and other's proxy analyzers, but some hosts and services don't pass by proxy rules, and I need something that work on "real time", that's why I need something to watch a forward to solve this problem and I want to integrate it with zabbix/cacti or anything else that is open source and free that can generate visual or a audible alarm. I was taking a look at observium, but it's not free and I don't know if it's "real time". Anyone can help me with it?

Zabbix uses SNMP so first you would have to set up accounting using 0) accounting rules in iptables with ipt_nfacct / xt_nfacct or user land tools like ipac-ng or bandwidthd (see Sourceforge) or Ntop or Netflow and then expose it via the right SNMP OID if the tool can't be queried differently. However your problem is that:


... next to exposing counters you also require some logic to alert only on bandwidth usage peaks and since I fear you're adjusting things manually I doubt that's going to work efficiently. I suggest instead you look into traffic shaping. Search for "LARTC" for gory details and "Wondershaper" if you want to get an idea of how to accomplish it.