0

We have an edge router connecting the Internet and our internal network. I needed to monitor the traffic going in and out, and make a report about which server/host uses most of our bandwidth and preferably which applications are the top consumes (torrents/http download, etc.)

Is it practical to port mirror (WAN interface) of our edge router and place a laptop running wireshark on it? just to see the statistics or usage?

I was just playing around nagios, and didn't seem to find this kind of monitoring.

Are there any applications that do this easily?

  • What Router model? – ETL Apr 28 '13 at 13:52
1

I'm gong to echo, for the most part, the answer JMurphy provided. Wireshark (IMO) doesn't lend itself very well to the type of analysis you're looking to do. Wireshark is better suited to detailed traffic analysis when you're trying to solve a specific network problem between two hosts.

What I would suggest would be one of two things:

  1. PRTG or MRTG. This can give you a high level overview of the traffic transiting your internet connection, such as traffic type (HTTP, SMTP, etc.) and the hosts involved in said traffic (source and destination) as well as being able to give you traffic summaries, such as the volume of HTTP traffic, etc.

  2. NetFlow or its alternative, depending on what your router and/or switches support. Again, this can give you a high level overview of the traffic transiting your internet connection, such as traffic type (HTTP, SMTP, etc.) and the hosts involved in said traffic (source and destination) as well as being able to give you traffic summaries, such as the volume of HTTP traffic, etc.

  • I've written a fair bit about Argus which is a good tool when you can't get flows straight from the devices. – Scott Pack May 15 '13 at 13:40
  • PRTG strikes me as overly complex and confusing; also I haven't been able to uninstall since trying it. – UpTide Oct 31 '17 at 16:44
1

I think you'll find that for even very small networks, Wireshark is going to be overwhelming to try to follow: it's collecting and showing the contents of every packet, even the smallest. You can take a capture file for a period of time, then save it and do successive filters for each host, and then again for each port/protocol of interest (e.g. TCP/80 for HTTP, TCP/22 for SSH, etc) but that's going to get cumbersome fast. You could write a shell script to analyze tcpdump files, but really the issue is that packet dumps like Wireshark or tcpdump produce are just too granular: you don't need that much information.

There are some alternatives. The kinds of software that are used to determine bandwidth for 95th percentile billing could potentially be used here: something like MTRG. I suspect it would be a stretch, though. In general, the industry standard for this kind of bandwidth monitoring is NetFlow or sFlow. For a small shop there are a number of free and/or open source tools available. You'll need a flow exporter (your edge router may do this already; if not, there are a number of free flow exporters available, including this one) and a flow collector.

  • For one device? As a diagnostic tool? Install free version of scrutininzer, done. – SpacemanSpiff Apr 29 '13 at 2:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.