Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to monitor the bandwidth usage on our network. I've come across two products that seem to fulfil our needs. MRTG and nTop, however I'm unsure which to use.

My work is a small company of about 10 people. We have a standard 4 port ADSL2 router that connects to a (Netgear) gigabit switch that gets used by our staff. DHCP is on the router itself, we have a designated fileserver/NAS that is running (Currently) Linux Ubuntu 8.04 LTS.

If I wanted to monitor usage of traffic, can I install either on the Linux box (others are Windows) and use SNMP to monitor the traffic or do I need to setup another box which will be our DHCP and have that monitoring the usage? How do they anaylse traffic otherwise?

share|improve this question

Personally I prefer cacti over MRTG. Cacti can do more than just switch/firewall port activity straight out of the box and scales a little better.

The advantage of nTop is that nTop can conceivably help you drill into network bumps and help you answer the question of "what is that?" You don't necessarily need netflows to make nTop work, it will be quite happy listening to a port mirror/monitor/RPA of the firewall's and working from that.

Personally I like something a little more robust than nTop. I use a fprobe/nfdump/nfsen setup (my setup notes). It lets you store the flows for a period of time, so you can go back after the fact and run more detailed analysis of the traffic for interesting periods.

share|improve this answer

It depends on what your router supports. If your router only supports SNMP, you have to use MRTG. This will give you a graph of the bandwidth used.

If your router supports Netflow then nTop is a better solution because you will get a graph of the bandwidth and be able to see details of the traffic. So you can know that computer A has downloaded N MB from website B and so on.

share|improve this answer

For my small office environment I dropped a small hub between the firewall and the interior switch(es). I installed ntop on a CentOS Linux machine which, in my case, is a VMware server client with its own "dedicated" NIC. The centos box connects to the hub and can easily see all the traffic to and from the firewall. No netflow necessary nor was there any need to change the network or replace any gear.

When I'm not monitoring I can just pull the hub out of the mix.

share|improve this answer

Since your network is switched, traffic between hosts will be confined to the path between them. In other words, your network monitoring device won't see it.

To solve this, your switches need to be able to mirror all traffic passing through towards a monitoring port. This way you can route a copy of all data to your monitoring device that runs ntop. If you're using basic switches this may be a problem.

share|improve this answer

If you have a manageable switch, you can setup a mirroring port for monitoring purpose. With an internet monitoring program connected to the mirroring port, you can monitor and record every internet usage and bandwidth usage . Products I would recommend: 1. "WFilter Enterprise" 2. "Websense"

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.