Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to know which machine is taking all the network bandwith.

It's there a tool I can use to monitor my local network and know which machine is taking all the LAN bandwith?

What do you think about Zenmap ?

share|improve this question

10 Answers 10

up vote 8 down vote accepted

We use MRTG (free) to monitor traffic on our routers and switches. This will only work if you are using managed switches that support SNMP.

share|improve this answer
MRTG, while great, will not tell you which of your LAN machines is using all of your Internet bandwidth. – mfinni Feb 9 '10 at 20:57
MRTG will show you traffic levels for all ports on your switch(es). If you use indexmaker (included in the MRTG distribution to generate your overview, all your ports will appear with bandwidth usage graphs on one page. Look for the port with the most activity (lots of blue and green on the graph). – tajh Feb 9 '10 at 22:05
Aha - you know what, I misread the OP. I thought he wanted to know what was using his Internet bandwidth. He said LAN bandwidth, so you're absolutely correct. – mfinni Feb 10 '10 at 1:07

What about the old email to staff@?

"I just bought a monitoring tool that will tell me who's using up the bandwidth. Here's a link to the paragraph in the employee handbook that explains the policy on internet use. I will be installing it tomorrow. You've been warned. Thanks."

Might work, and if not, you've got some suggestions from the nice people here for actually following through on the threat.

share|improve this answer
Love it. So cynical, it just might work! – Chris_K Feb 9 '10 at 22:52
Good idea, but i already try it :-) – Cédric Boivin Feb 10 '10 at 18:24
I thought we were moving away from the BOFH ( model of network administration. :P – Joe Feb 10 '10 at 18:54
Looks like we're only moving away from its stories, as that page hasn't been updated for a while :-/ – Massimo Feb 11 '10 at 6:58
If you've already tried the threat, for god's sake, follow through, and humiliate someone publicly, otherwise you'll lose what leverage you do have. – Jamie Feb 11 '10 at 15:23

If you find switching to a Hubbed network temporarily unacceptable or find the other approaches too time consuming, You can use the tried and true tactic of ARP poisoning and sniffing their traffic (The caveat with this approach is that you WILL bottleneck your connection with your NIC/Cabling speed and will dramatically slow down, perhaps DOS a large network. The second caveat is that your local IDS will complain, profusely.)

If you're with Cisco, You can SSH in and do show interface, provided you suspect that you're in the switch whose access ports are connnected to the culprit.

If you're with Juniper, I believe the command show interfaces detail is applicable in the above scenario.

share|improve this answer

You are probably on a switched network. The practical way you can sniff/capture all the traffic is to set up a mirror port on that switch. You then can put a computer into that mirror port running wireshark to capture all the traffic.

share|improve this answer

Yup, you can do it a few ways. You can measure it directly off either the internal or external port of your router that gets your LAN to the internet. Then, your router has to support something like NetFlow or similar technologies, and you also need a computer running software to capture that.

You could also install a proxy server (in a number of ways) that supports the sort of report you're looking for.

share|improve this answer

There are several. For proper analysis you'll want a tool that interfaces with your networking equipment, such as NetFlow Analyzer:

share|improve this answer

If your router supports netflow then it likely supports a top-talker capability which will give you the top bandwidth hogs at the command line if you don't need graphs and fancy reports. Also if you don't have access to the router but you do have access to the LAN switches you could mirror the port leading to the router or an entire vlan and analyze the traffic with a packet sniffer like Wireshark

share|improve this answer

As Kyle said, you're probably on a switched network (almost everyone does nowadays); a sniffer will not help you here, because a computer connected to a switch port can only see traffic to/from itself and broadcasts.

If your switch supports it, set up a monitor port and connect a sniffer to that (WireShark is truly great for this); if it doesn't, you'll have to find some other way...

If what bothers you is Internet bandwidth, you can put a small hub (not a switch, a true hub) between your router and your main switch, and connect a sniffer there; it will be able to sniff all traffic flowing through the hub's ports.

share|improve this answer

Similar to what Massimo suggests, I have a small hub between our firewall and the "main" internal switch. I have a linux VM running ntop also plugged into that hub and this allows me to monitor all inbound/outbound traffic easily.

If necessary I can move the hub around to monitor various segments, but I've found most "omg the network is slow" issues are directly traced to someone moving large amounts of data to or from the internet.

share|improve this answer

I use Smoothwall for our firewall and it has what you need built in. i.e. There's a display page that shows the bandwidth being used by IP address. It appears to refresh about every second, which is near enough real time for my purposes. Cross reference the IP address with the proxy logs and you can get a pretty good idea of what they're up to as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.