16

I can see from our ISP stats that a large amount of bandwidth is being used throughout the day, I suspect it's someone using our wireless router although I'm not definite. Our PC's all run various types of windows, are there utilities/sniffers that I can use to detect where the bandwidth is going?

Improve this question
5
  • 13
    you're telling me I should wait for networkloadfault.com? Jeez give me a break already.
    – MrTelly
    May 12, 2009 at 13:11
  • BTW our wireless is secure, it's someone we know who's using the bandwidth, we just don't know who it is, for all we know it's legit anyway we just need to know who to ask, and know I don't think spamming the whole company is the answer.
    – MrTelly
    May 12, 2009 at 13:13
  • 7
    It doesn't have to be a server question, it has to be a sysadmin question - which this clearly is.
    – user640
    May 12, 2009 at 13:14
  • Could you please supply your wireless make and model? It is easier to recommend what you ask if those details are known.
    – user1797
    May 12, 2009 at 13:22
  • Your network setup would be highly useful information for this. I'm not sure if this is a home or office setting but if its a business and your router/firewall/wireless controller supports IPFIX/Netflow data you can see every conversation going through it.
    – sclarson
    May 12, 2009 at 20:57

9 Answers 9

Reset to default
15

You can install a PC on a hub (or managed switch emulating a hub) with the router, and use Wireshark to capture all the traffic. From here you can get some useful metrics to point you to your bandwidth hogs.

Improve this answer
1
  • That could be a decently dramatic performance hit on a corporate network.
    – sclarson
    Jun 7, 2009 at 5:24
13

Adding to Jon B's answer, I have also used ntop to get a good idea of where traffic is going. I downloaded a Virtual Appliance to make it easier to set up.

Improve this answer
2
  • Just a warning ntop's logs pile up fast.
    – reconbot
    May 12, 2009 at 15:56
  • You could also use ntop to export netflows for logging usage. ntop.org/netflow.html You can get netflow data Tomato or m0n0wall as well.
    – sclarson
    May 13, 2009 at 13:44
5

Wireshark (used to be called Ethereal) will tell you everything you want to know.

Improve this answer
2

Can you give us more details about your network setup? I can propose two different approaches:

  1. Depending on the type of wireless device you have, you may be able to use a network management application that uses SNMP to pull down stats from the AP. Most enterprise APs will have a MIB table that tracks the list of associated client, their signal quality, and the number of bytes used. Similarly, your router may have a MIB that tracks traffic by IP address.

  2. You can use a wired traffic sniffer (wireshark, etherpeek) to watch the traffic. Those tools can usually give you a breakdown of traffic by user. You'd have to sniff the traffic before it hits your router (if your router does NAT). You can use a hub (though those are really hard to find these days) or turn on port mirroring on a managed switch. You can also use a wireless sniffer, but if the network is encrypted, you'll just get an idea of the volume of traffic from each user, not where the traffic is destined.

Improve this answer
2

Depending on the make and model of the wireless access point/switch you are using, Tomato might be just what you are after. It provides a nice bandwidth monitor, among other things.

Also, a bit costly, but it seems it would do what you want as well.

Improve this answer
2
  • I love Tomato & have used it for several years but I don't think it does per client bandwidth monitoring. Am I wrong?
    – Gareth
    May 13, 2009 at 2:33
  • No quite yet, at that level, indeed. It is coming though. Yet, the current bandwidth monitoring will provide measures and the time associated with it. Pinpointing a specific subset of users should be easier having bandw./time. That's why I originally asked make and model of the wireless AP or switch. Cisco has very nice management and monitoring packages, but those work only with their hardware.
    – user1797
    May 13, 2009 at 3:57
1

Your router likely has a way to show what clients are connected through it, possibly as DHCP clients. That would identify who is connecting to your wireless router, although it wouldn't necessarily tell you who was using your bandwidth.

Improve this answer
2
  • 1
    You're right it tells me who, but not how much
    – MrTelly
    May 12, 2009 at 13:12
  • And rogue users may not use DHCP at all but simply pick an unused IP address. Better to query the router for its ARP table, this would be more difficult to forge.
    – bortzmeyer
    Jun 7, 2009 at 21:35
1

If you aren't already I'd highly recommend a program such as Cacti (which can be used in conjunction with ntop) to grab the traffic stats from your switches (and hopefully your WAPs as well). This can help you pin down when and where the traffic is originating.

Additionally it will also give you a good feel for the flow of traffic - and anomalies in traffic tend to stand out in the graphs a bit more than just browsing logs.

Improve this answer
1

If your router supports it, you could turn on netflow monitoring. Flows would show you exactly what you are looking for.

Improve this answer
0

Most wireless routers log MACs of the connecting WiFi cards, many also allow monitoring who is actually connected. As for sniffing WiFi, the standard tool is Kismet.

"Someone" refers to someone not actually authorized to use it, who's hijacking your signal?

To protect your WiFi you should take following steps:

  1. deter script-kiddies (won't work against experienced work-drivers):

    • Turn off your SSID broadcasting
    • Limit connection only to given list of MACs
    • Limit DHCP only to static MAC -> IP assigments

  2. use WPA2 (with EAP-PSK, use random passphrase).

  3. for real hardcore security, use WPA2 with 802.1X authentication server.

Improve this answer
2
  • MAC spoofing (#2.2 and kinda' #2.3) should NEVER be relied on, and in reality is not worth the time, I've hacked many WIFI networks with it enabled (purely educational I assure you) that had it enabled. Even most script-kiddies know about this cause it's posted all over every WIFI hacking website/forum. Definatly go WPA2 + Radius Server ("802.1X authentication server") this is, from my experience, the only real form of security, WEP & WPA have been beat
    – Unkwntech
    May 13, 2009 at 2:33
  • I've "hacked" many WiFi networks by choosing "automatically connect to any available network". True, the WPA2 is the only safe way, but that might be unavailable, because of legacy hardware. A script-kiddie, looking for a free ride will choose unprotected network, rather then even weakly protected one.
    – vartec
    May 13, 2009 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .