We have an IPCop firewall/proxy installed in our network, and although I can use iftop to somewhat take a look at how the clients are using the Internet, is it possible to monitor it from outside the proxy with something like ntop?

Note that I'm not interested in LAN traffic, only traffic that goes to/from the Internet.


Have ntop kick out netflow data and you can get all sorts of fun reports.



Some people do just write their own flow parsers as well if you're into that sort of thing.

More information about netflow data:

http://www.manageengine.com/products/netflow/cisco-netflow.html http://www.computerperformance.co.uk/HealthCheck/netflow_monitoring.htm

  • would any of this solution work in a sonicwall enviornment? – Saif Khan May 14 '09 at 19:34
  • Which model sonicwall? – sclarson May 14 '09 at 20:03
  • No NetFlow available :( – Ivan May 17 '09 at 23:38

We've used IPAudit http://ipaudit.sourceforge.net/. It could give you pretty granular info about outgoing/incoming bandwidth.

Here are some screenshots: enter image description here enter image description here

  • That looks handy, but I couldn't get it to play with gnuplot from Ubuntu 8.10 – Ivan May 18 '09 at 0:54

I couldn't find something that wouldn't also mix LAN traffic, so I settled for IPTraf. I do have to use it from the firewall machine, but since it's a text program it's no big deal.

By using filters and named MACs, I can quickly take a look at Internet traffic.

I also found an interesting program called EtherApe. It graphs local network connections, check it out.

Another simple monitoring tool, BandwidthD.

Cacti looks interesting too, but too bloated for what I want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.