1

I know this looks like some of the other questions but they don't seem to have been answered as fully as I hoped.

On our network we have a bunch of PC's that are connected to the internet. Now for the past few weeks it seems that our downloading bandwidth is being used up. Now we have a very basic tool to monitor inbound and outbound traffic, so that's how I know it is inbound(download) traffic. Now I need to work out what machine(s) is causing this, so far the network monitoring tools either monitor internal network traffic which is crazy anyway and looks like the 'matrix' or it works out total bandwidth used, which is what we have anyway.

I need a tool that can tell me which machine on our network is using the most internet traffic (inbound and outbound) and if not why not?

We have a Windows network. We have unmanaged switches.

1
  • If you have information on internal flows can you identify traffic from non-local addresses as this latter will be what you have downloaded from the internet (assuming your network is just the local PCs on one subnet and everything else is on the internet)?
    – mas
    Jul 27, 2009 at 20:47

5 Answers 5

3

To analyze which device is generating/receiving the most traffic you are going to need network equipment that can collect these statistics.

As mentioned in a previous answer the easiest way to do this is with a managed switch which will allow you to poll the traffic on each port.

Another method is a router that can either collect traffic accounting data on a per MAC address level or export network traffic in "NetFlow" format which can be analyzed by a tool such as NFSen

The final method is going to be installing some sort of packet sniffer (e.g. a PC running Wireshark). In order to get this to work on an unmanaged switch you will need to either install the sniffing PC in-line to the traffic (i.e. two network cards configured for L2 forwarding) or install some form of Ethernet tap between the switch and router.

The less managed network hardware you have in the network the more networking knowledge you will need to collect the statistics.

2

You need to look at getting SNMP stats from your network switches to find out which network port is getting the traffic.

Common tools such as Cacti and Munin can graph this for you.

If you don't have managed switches, go get some!

6
  • Unfortunately, I just looked up our switch and we have an unmanaged netgear switch. Any other ideas?
    – Harvy
    Jul 27, 2009 at 15:14
  • yes, buy a real switch! The money you save on fixing your network and getting full productivity back will more than outweigh the cost.
    – Alnitak
    Jul 27, 2009 at 16:13
  • May need more than simple SNMP stats to identify which port is getting most of the internet traffic as opposed to most traffic from other switch ports. Netflow stats can give this but switches with that capability are more expensive than simpler managed switches. A managed switch with port mirroring and a tool like wireshark is probably the best compromise.
    – mas
    Jul 27, 2009 at 20:49
  • "Buy a real switch" - please, an SMB with 15 people might not be able to afford a $1500 switch, when an unmanaged switch has been working fine for them right up until now. This is a very unhelpful suggestion. Jul 28, 2009 at 2:44
  • on the contrary, a 16 port gigabit managed switch can be had for about 250 bucks (AT GS950/16).
    – Alnitak
    Jul 28, 2009 at 6:20
2

Aside from a software solution, one option that doesn't involve installing any software is to check which port on the switch is flashing the most over an extended period.

If it's someone downloading movies etc at night when most machines should be idle then you'll see this fairly quickly when most of the network is idle. If it's happening during the day then it might be hard to tell.

You might want to tighten up your firewall to block bittorrent etc.

1

As a network admin and security wonk, I lean towards an outbound default deny policy and a proxy server.

Barring that, I'd second the suggestion of implementing a netflow collector/analyzer. Now, doing that without the ability to span ports on your unmanaged switch means either:

  1. buy a tap and install it inline
  2. push all of your traffic through a box that's capable of both passing the traffic and creating netflows, or
  3. a commercial solution that does #2 for you

Depending on how important your network is to your business, a managed switch and even a smaller SOHO commercial firewall are solid investments in your infrastructure. Before you dismiss hardware as an option, check prices with some grey market vendors. I bought a Cisco 6500 chassis, power supply, and single supervisor for under $3k for a lab environment.

0

Instead of using a packet sniffer like Wireshark, you probably want a system that deals in NetFlows. This is a way of abstracting network connections so that you can see source, destination, size, and longevity of connections.

The difference is that you don't really care that the user is downloading some scene with Westley Snipes in it; you only care that user $X is bit-torrenting.

The advantage of this is that it is far more practical to store information gathered this way for a long period of time. In my case, I can store three months worth of NetFlows for my primary internet connection on a 60GB disk. This gives me a much better ability to go back in time to figure out what happened when...

I would set up something like nfsen (here are my notes for installing nfsen on Linux) on a wire that gets a copy of all traffic that the inside of your firewall device sees.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .