Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm the appointed IT guy at a business with 20 pcs, we have 1 sbs 2003 server, a consumer grade soho modem/router and a few network switches making up our lan.

We keep on hitting our monthly ISP quota of 60 gb and I don't think its through typical use. I suspect something rogue in our lan but all pcs have av and aren't reporting any issues.

Is there any software which will let me track down the errant computer and end its downloading days. I've had a recent look around for programs to help me find it and tried the ones already mentiond in related questions on this site but nothing is letting me easily identify which pc is using the quota.

As far as I can tell none of my hardware supports SNMP so the only thing I can think of is trying to slip a smoothwall firewall between the network and the router/modem (but thats a pain because its a whole extra computer I have to find, configure and install.

Many Thanks

share|improve this question
Does everything going out to the internet go through your SBS 2003 Server? At our office we use two nic cards and everything is routed through the server ( Nic 1 WAN / Nic 2 LAN ). – Breadtruck Aug 21 '09 at 10:15
What model router do you have? – JS. Aug 21 '09 at 10:31
Breadtruck - our SBS sever does have 2 nics but it wasn't setup that way when I joined the company. Would you use ISA Server to enable you to do this routing or is there something else built into SBS JS - Router is a soho netgear router, pretty basic – Matthew Walker Aug 25 '09 at 3:41

11 Answers 11

up vote 9 down vote accepted

If you do have a spare PC smoothwall/ipcop is an excellent solution and the configuration/installation is a 10 minute job. I'd also recommend the advanced proxy add on.

share|improve this answer
+1 I have been looking for a solution like this also....installing it now..thanks – cop1152 Aug 21 '09 at 13:06
will smoothwall give this type of per ip internet usage reporting "out of the box" or would I need to customise it to get that sort of information? – Matthew Walker Aug 25 '09 at 3:20
Sorry, I haven't been signing on. I think you'd need something like calamaris to do your analysis. – ColJL Sep 9 '09 at 10:53

Presuming one of your switches has an unused gig port, you could mirror all traffic to it and plug a machine running ntop into it to get very detailed traffic reports. But yes this requires you to find, configure and install a new machine.

share|improve this answer
or use a VM machine plugged bridged to the port, i beleive ntop can work off a bridged virtual NIC – Jimsmithkka Aug 21 '09 at 13:33
Or just drop a cheap hub between the rest of the network and the firewall. – Chris_K Aug 21 '09 at 14:05

the easiest setup in your given situation (no new hardware available) is to configure sbs as a gateway (most new pc's have at least 2 nic's) and then use a traffic monitoring tool

my choice would be a linux gateway, which is more flexible with traffic management

share|improve this answer

Wireshark will do the trick for you, but you need to have it run somewhere where it can see all of the traffic. We use a NetGear GS108T switch for that, as it provides the facility to monitor all traffic on all ports on a separate port.

share|improve this answer
Wireshark is not the right tool for the job. It can be used to debug a specific networking problem by inspecting the content of the packets, not to monitor network usage. – Anonymous Aug 21 '09 at 11:08

Only open incomming connections for mail(25) and http(80) https(143)... This usually blocks all p2p traffic...

share|improve this answer
small correction: https (443). Unfortunately, most IM and p2p apps will cheerfully go through port 80 these days. – Chris_K Aug 21 '09 at 14:13
You'd really need to block the P2P outbound as well.... – Brett G Aug 21 '09 at 15:13
Cheerfully! :) That word needs to be used more! Anyhow, you are right! ;) Have all inet traffic go through a different port as well as email!... – Sniek NL Aug 28 '09 at 12:19

Untangle FTW! I installed it on a spare pc and set it up as a bridge between router and network. Fantastic!! Untangle

share|improve this answer
In addition, you can use Untangle to do some preliminary spam filtering, in addition to whatever spam filtering you already have on the Exchange server. – phuzion Aug 21 '09 at 14:19

You can monitor bandwidth usage / network utilization with Nagios. Nagios supports monitoring of hosts, services, applications, and network. Apart from these, Nagios can also be used to alert you if the threshold exceeds what you have specified.

You can also Try MRTG, it uses SNMP to monitor your bandwidth usage and is able to generate graphs which provide a live visual representation of the traffic.

You can even integrate these two together.

Some other alternatives to Nagios - OpenNMS - Cacti

share|improve this answer

Generally most routers monitor this. Router is the entry point to the "External world" so that is the easiest point to monitor

share|improve this answer
To add to that, you should be able to setup some logging on that router to log info to a particular computer. What you can log will depend on that Router sitting on the entry point – Breadtruck Aug 21 '09 at 10:22
router is a very basic netgear unit with only basic logging. only really records firewall blocked events. It does support ip syslogging so I've setup a trial of that with a program called Kiwi syslog so I can keep a longer term record of whats being blocked. It may help. Thanks for your suggestion. – Matthew Walker Aug 25 '09 at 3:08

Maybe PRTG would work for you. There is a free trial. Monitor your switch if you can. I have used this before by just loading it on my PC and monitoring my switch ports for excessive bandwidth.

You could also try spiceworks. I haven't used it yet but it could do what you want. Both are super easy to install.

share|improve this answer

You can also try something like MRTG to determine when some peak bandwidth sucking is happening.

It would require an SNMP device though to gather the information.

share|improve this answer

I definitely recommend Ntop as well. Another tool I use on small networks/internet connections is tcptrack. It's a command line tool that shows each live tcp connection with the source and destination IP address and how many kbps each one is using.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.