Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to monitor traffic coming in and out of my server. Knowing the total in/out bandwidth is good, but ideally I would like to know how much traffic was sent to what address (we are talking about static IP addresses).

Is there a tool that would allow me to track bandwidth usage by destination/source?

Alternatively, can you recommend a good library or API for implementing such a functionality?

Note: At this stage I am looking for a Windows-based tool, but I would like to know of options available for any platform.

Thank you,

share|improve this question
    
What sort of server? –  womble Sep 1 '11 at 23:07
    
@womble: Windows-based at this stage... most likely will move to linux at deployment –  Goro Sep 1 '11 at 23:09
    
Can you elaborate on the reasons for downvote? –  Goro Sep 1 '11 at 23:10
1  
This is what this question sounds like to other people: "I need very specific information, but I'm not going to provide any details or give any specific info to the people that I'm asking for help." –  MDMarra Sep 1 '11 at 23:12
    
@MarkM To me it sounds like "I need to fix my problem but I don't know what I'm dealing with"; knowing the right terminology in the first place is half the problem. I know because it happened to me in the past. –  Andrew Sep 1 '11 at 23:22
show 1 more comment

5 Answers

up vote 2 down vote accepted

Netflow is the end all, be all for this type of monitoring. While there are netflow tools for Windows, my favorite toolset is nfdump+nfsen on Linux/Unix for collection and web-based report generation respectively. I have found this toolset does everything I want, and they're free. As for collecting flows for later analysis with one of these tools, your router may support netflow export. If it doesn't, or if you don't have access to the router, you may configure your managed switch (if you have one) to mirror the ports you want to monitor to a dedicated monitoring port. Then you can use something like fprobe (also on Linux.) I recommend the pcap based fprobe over the ulog one because it was the easiest for me to get working.

share|improve this answer
add comment

Another interesting tool is ntop which will allow you to monitor all traffic. I've previously used it to analyze the traffic with good results. Is free software and you can use it on different OS (although Linux is preferred).

share|improve this answer
add comment

If you don't mind using a cool rocket-propelled grenade to hunt insects, it would be fairly quick to install Wireshark, maybe watch a video and set up a quick capture by interface. The Endpoints display will give you what you want, and there are many more ways to slice & dice. Remarkably usable despite its vast depth.

share|improve this answer
    
Wireshark tends to give me information overload unless I'm looking for something specific; can you recommend any good analysis tools for it? –  Andrew Sep 1 '11 at 23:41
    
The top few items on the Statistics menu do useful overviews, and Expert Infos can be a starting point: wireshark.org/docs/wsug_html_chunked/ChAdvExpert.html Is this the kind of analysis you mean? –  Paul Sep 2 '11 at 0:08
add comment

A Packet sniffer in PRTG, installed on the server, will give you the info you're looking for.

http://www.paessler.com/manuals/prtg8/packet_sniffer_header_sensor.htm

share|improve this answer
add comment

In terms of basic tools I can think of two:

ntop is a netflow / sFlow based tool that could integrate with other netflow tools.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.