Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm connected to a LAN in my office, which has many users. Using NAT all the machines get a global IP address through which they can access Internet. What i'm trying to figure out is, is it possible using a sniffer like Wireshark, to determine who's consuming the most bandwidth or which IP address is downloading maximum content from the Internet, slowing down others' connectivity speed.

I tried using Wireshark in promiscuous mode , but don't know what filters to apply in order to sniff download traffic of other machines.

So how can i go ahead and achieve this network monitoring ?

share|improve this question

migrated from Feb 25 '12 at 19:50

This question came from our site for information security professionals.

iptraf and iptop are good for this if you have access to a shell on your gateway. If not then the answer will depend on what sort of gareway you have. – Ladadadada Feb 25 '12 at 8:01
shouldn't this question belong to serverfault? – Yoav Aner Feb 25 '12 at 8:43
@YoavAner when did Server Fault start accepting networking stuff again? Last time I check networking stuff gets shuffled off to SuperUser with the rest of the stuff no one knows what to do with. – WalterJ89 Feb 25 '12 at 8:55
In a switched environment you'll only see the traffic of your own machine. Unless you are arp poisoning but that's not ideal. You'll have to do something on your gateway or switches. some switches and routers have a way to mirror traffic for sniffing. Just keep in mind that the performance of the switch or router might suffer. – WalterJ89 Feb 25 '12 at 10:55
I'd look into a router with a custom firmware. My friend uses TomatoUSB and is very happy with it. It allows you to do traffic priorization (at least for upstream), and offers some built in monitoring features. – CodeInChaos Feb 25 '12 at 12:39

If you have a large number of users (say 20+), and this is becoming a real problem, it might be time to implement an HTTP proxy that all web traffic must pass through to get out.

This would also mean that you can assign users credentials that they must enter in order to get out to the internet, which saves you the issue of having to translate a monitored IP address that is using heaps of traffic back to a computer and therefore a person.

If you are looking for a free solution, this could be something like Squid on a DD-WRT router, or if you want to put some $$ in you could get Microsoft FTMG Server or the likes of WebMarshall.

Obviously this would require that you can stop web traffic getting out directly through the router - except if it comes from the proxy server.

Good luck!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.