Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've setup a network monitoring using Observium but I see something really strange, on 3 buildings (2 Production laboratories and 1 office) (There are no servers connected on those switchs), the network is more loaded at night than at day .

Here are the graphs (one per building, this is the global traffic on the whole switch) :

enter image description here

enter image description here

enter image description here

On those swith are connected :

  • Desktops (should be shutdown at night)
  • Wyse client (same thing)
  • CCTV
  • Printers
  • Environment monitoring

Have you any idea of what can this be ?

Thank you

share|improve this question
    
Soooo? What was it? –  ewwhite Nov 5 '12 at 21:48
    
We still don't know what was it –  Kedare Nov 6 '12 at 9:35
    
We just found what was it, it was our CCTV system. :) –  Kedare Nov 15 '12 at 10:08

2 Answers 2

up vote 1 down vote accepted

We just found it was the CCTV network that uses more data by night

share|improve this answer

Backups? Windows updates? pr0n? - Is this a problem?

I think this depends more on your environment and your users' activities more than anything else. We can't necessarily tell you what's happening in your infrastructure.

Observium is a good start. You could probe the network, perhaps set up Wireshark or Ntop on a span port on the switch... That can help you analyze traffic. Do you have any insight into firewall/internet traffic during those times of higher activity?

share|improve this answer
    
This is not a problem, but this is not something normal. Windows updates should not occurs because PCs are shutdown and Update frequency is not daily. There are no automatic backup on the PCs. Offices are closed at night and locks with alarm so there isn't anybody inside. Laboratories only opens at 5AM. That what's strange is that the used bandwidth is very flat, it should be more with spikes if that was standard user activity, isn't it ? –  Kedare Oct 30 '12 at 8:59
1  
+1 for Ntop. We had a similar issue with a customer, and high traffic was observed when there was no one. It was the hundred users' animated screensavers through Citrix. Network flows identification can really help this kind of troubleshooting. –  petrus Nov 5 '12 at 21:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.