[Discuss] Network monitoring tool recommendation

[Matt Shields]

On Wed, Feb 6, 2013 at 12:21 PM, Drew Van Zandt <drew.vanzandt at gmail.com>wrote:

> Cacti, Nagios, and Intellipool are all solid for this.
>
> *
> Drew Van Zandt
> Cam # US2010035593 (M:Liam Hopkins R: Bastian Rotgeld)
> Domain Coordinator, MA-003-D.  Masquerade aVST
> *
>
>
> On Wed, Feb 6, 2013 at 12:11 PM, David Rosenstrauch <darose at darose.net
> >wrote:
>
> > We've got some machine (or machines) sucking up a lot of bandwidth on our
> > network.  I'm trying to pin down exactly what, but not having much luck
> so
> > far.
> >
> > The network's got about a dozen machines, behind a firewall.  What I'd
> > like to see is a high-level view of the whole network's bandwidth usage
> > over the span of, say, 24 hours.  I.e., which machines are using the most
> > bandwidth (i.e., in Gb), and connections to which external sites are
> > causing most of the hogging.
> >
> > Clearly, micro-level tools like iftop aren't going to cut it here, as
> they
> > only show me a) what's using bandwidth right now, and b) an individual
> > machine basis.
> >
> > I tried running darkstat on each machine in the network, but it didn't
> > really give me what I was looking for.  Again, the reporting was
> > per-machine, and so didn't provide a comprehensive view.  (Among other
> > problems.)
> >
> > Bandwidthd looks like it might have some promise, but would take some
> time
> > to set up to give me a comprehensive view.  (I.e., configure a pgsql
> > database.)
> >
> >
> > Anyone have any particular recommendations for a situation like this?
> >
> > Thanks,
> >
> > DR
>

Also try ntop.  Set it up on a standalone computer.  2 network ports, one
for management, one where you mirror all your traffic at the switchport to
it and have the interface in promiscuous mode.  Then it'll give you nice
charts to show you who is talking to what (ie. User1 is streaming content
from Youtube, etc).

Matt