Real-time traffic monitoring router / firewall device

Question

I'm looking for a router & firewall device that will provide built-in bandwidth monitoring; meaning, I go to the web control panel for the device and I can see a real-time breakdown of how much traffic each IP is using (and even better, identify the MAC of each machine so I can exclude them from the network if necessary). I know there's third party solutions that can analyze syslogs in real time, but really what I want is a simple, plug-and-play device that offers this kind of real-time analysis out of the box.

Answer 1

I'm going to advocate Pfsense again. PFsense can by default graph outgoing / ingoing bandwidth. If you add the Bandwithd plugin, you can graph the traffic coming out of each node of your network on a per-IP basis. It even displays the type of traffic.

It's really simple to setup and works very well. You can put in transparently on your network by putting it in network bridge.

Answer 2

I believe smoothwall offers built-in graphing via MRTG. Not sure if it will do reporting via internal IP's out of the box. I think there are some other forks of this project that do similar things, but i can't remember the names.

ntop is probably more flexible for your needs. You should be able to run this on any linux distro that you can purpose as a firewall with iptables.

Answer 3

if you have netflow capable devices use it. although it originated at cisco many hardware vendors support it. if it´s too taxing on your hardware use sampled netflow.

but most of all get a netflow agregator like http://nfsen.sourceforge.net/ for accumulating and visualizing the data.

Answer 4

I second PFSense, as a very satisfied user.

Also, hosts3d (formerly homestead) if you're running *NIX / *BSD. It is IMHO the most underrated network utility that currently exists.

Answer 5

MAC filtering is not very difficult to get around.

You can just force all traffic to go through a proxy, for example squid, and force authentication.

Block direct access to the internet, so the only way to get out is via the proxy.

Then let squid do the accounting for you.

Answer 6

iftop is a useful *nix utility for watching traffic. Depending on what firewall/router infrastructure you have, it might fit the bill.

Answer 7

Untangle is a great way to go.

1. Plug and play
2. FOSS
3. Great features, including reporting.

http://www.untangle.com/Open-Source-Package