I'm the appointed IT guy at a business with 20 pcs, we have 1 sbs 2003 server, a consumer grade soho modem/router and a few network switches making up our lan.

We keep on hitting our monthly ISP quota of 60 gb and I don't think its through typical use. I suspect something rogue in our lan but all pcs have av and aren't reporting any issues.

Is there any software which will let me track down the errant computer and end its downloading days. I've had a recent look around for programs to help me find it and tried the ones already mentiond in related questions on this site but nothing is letting me easily identify which pc is using the quota.

As far as I can tell none of my hardware supports SNMP so the only thing I can think of is trying to slip a smoothwall firewall between the network and the router/modem (but thats a pain because its a whole extra computer I have to find, configure and install.

Many Thanks

  • Does everything going out to the internet go through your SBS 2003 Server? At our office we use two nic cards and everything is routed through the server ( Nic 1 WAN / Nic 2 LAN ).
    – Breadtruck
    Aug 21, 2009 at 10:15
  • What model router do you have?
    – JS.
    Aug 21, 2009 at 10:31
  • Breadtruck - our SBS sever does have 2 nics but it wasn't setup that way when I joined the company. Would you use ISA Server to enable you to do this routing or is there something else built into SBS JS - Router is a soho netgear router, pretty basic Aug 25, 2009 at 3:41

11 Answers 11


If you do have a spare PC smoothwall/ipcop is an excellent solution and the configuration/installation is a 10 minute job. I'd also recommend the advanced proxy add on.

  • +1 I have been looking for a solution like this also....installing it now..thanks
    – cop1152
    Aug 21, 2009 at 13:06
  • 1
    will smoothwall give this type of per ip internet usage reporting "out of the box" or would I need to customise it to get that sort of information? Aug 25, 2009 at 3:20
  • Sorry, I haven't been signing on. I think you'd need something like calamaris to do your analysis.
    – ColJL
    Sep 9, 2009 at 10:53

Presuming one of your switches has an unused gig port, you could mirror all traffic to it and plug a machine running ntop http://www.ntop.org/ into it to get very detailed traffic reports. But yes this requires you to find, configure and install a new machine.

  • 1
    or use a VM machine plugged bridged to the port, i beleive ntop can work off a bridged virtual NIC Aug 21, 2009 at 13:33
  • 1
    Or just drop a cheap hub between the rest of the network and the firewall.
    – Chris_K
    Aug 21, 2009 at 14:05

the easiest setup in your given situation (no new hardware available) is to configure sbs as a gateway (most new pc's have at least 2 nic's) and then use a traffic monitoring tool

my choice would be a linux gateway, which is more flexible with traffic management


Wireshark will do the trick for you, but you need to have it run somewhere where it can see all of the traffic. We use a NetGear GS108T switch for that, as it provides the facility to monitor all traffic on all ports on a separate port.

  • 2
    Wireshark is not the right tool for the job. It can be used to debug a specific networking problem by inspecting the content of the packets, not to monitor network usage.
    – Anonymous
    Aug 21, 2009 at 11:08

Only open incomming connections for mail(25) and http(80) https(143)... This usually blocks all p2p traffic...

  • small correction: https (443). Unfortunately, most IM and p2p apps will cheerfully go through port 80 these days.
    – Chris_K
    Aug 21, 2009 at 14:13
  • You'd really need to block the P2P outbound as well....
    – Brett G
    Aug 21, 2009 at 15:13
  • Cheerfully! :) That word needs to be used more! Anyhow, you are right! ;) Have all inet traffic go through a different port as well as email!...
    – Sniek NL
    Aug 28, 2009 at 12:19

Untangle FTW! I installed it on a spare pc and set it up as a bridge between router and network. Fantastic!! Untangle

  • In addition, you can use Untangle to do some preliminary spam filtering, in addition to whatever spam filtering you already have on the Exchange server.
    – phuzion
    Aug 21, 2009 at 14:19

You can monitor bandwidth usage / network utilization with Nagios. Nagios supports monitoring of hosts, services, applications, and network. Apart from these, Nagios can also be used to alert you if the threshold exceeds what you have specified.

You can also Try MRTG, it uses SNMP to monitor your bandwidth usage and is able to generate graphs which provide a live visual representation of the traffic.

You can even integrate these two together.

Some other alternatives to Nagios - OpenNMS - Cacti


Generally most routers monitor this. Router is the entry point to the "External world" so that is the easiest point to monitor

  • To add to that, you should be able to setup some logging on that router to log info to a particular computer. What you can log will depend on that Router sitting on the entry point
    – Breadtruck
    Aug 21, 2009 at 10:22
  • router is a very basic netgear unit with only basic logging. only really records firewall blocked events. It does support ip syslogging so I've setup a trial of that with a program called Kiwi syslog so I can keep a longer term record of whats being blocked. It may help. Thanks for your suggestion. Aug 25, 2009 at 3:08

Maybe PRTG would work for you. There is a free trial. Monitor your switch if you can. I have used this before by just loading it on my PC and monitoring my switch ports for excessive bandwidth.

You could also try spiceworks. I haven't used it yet but it could do what you want. Both are super easy to install.


You can also try something like MRTG to determine when some peak bandwidth sucking is happening.

It would require an SNMP device though to gather the information.


I definitely recommend Ntop as well. Another tool I use on small networks/internet connections is tcptrack. It's a command line tool that shows each live tcp connection with the source and destination IP address and how many kbps each one is using.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .