PDA

View Full Version : Bandwidth Blowout



Obelix
07-09-2010, 07:41 AM
Okay we have had a massive bandwidth blowout, and the boss wants me to investigate it.

As it is now a historical thing I am not sure if I can. However I want to monitor what is happening going forward.

Is the a program that I can install on the server, instead of each workstation that will allow me to report what our bandwidth is being used on? How much each computer is using? etc etc.

I know that I can use the Telecom Usage meter, but that does not tell me what the bandwidth is being used on and does not show what IP address is using the most.

The information contained within the router is to technical for him to understand.

Chilling_Silence
07-09-2010, 08:06 AM
A few things:
1) What router are you currently using?
2) Are you using any form of a small business server, or a proxy?

Try either WebMonitor if you're after a ready-to-roll product, or Gargoyle Firmware if you're feeling adventurous ;)

utopian201
07-09-2010, 10:12 AM
when you mean server, do you mean a server which all internet traffic passes through? If so, install Squid. It is a proxy which will save you bandwidth, but also tells you how much traffic is used by each computer.

If it is a small network (several computers), you can use a custom firmware on your router (eg tomato/dd-wrt). Not sure if they are robust enough for enterprise use, but they can monitor per mac address bandwidth.

gcarmich
07-09-2010, 11:41 AM
squid is a http proxy, it won't tell you how much traffic is being used by programs that don't use http.

Better understanding of how the network is setup will aide in giving a good sollution.

gcarmich
07-09-2010, 11:44 AM
I'd normally suggest an ntop box for this sort of thing, however it must be able to see all the traffic going to and from the internet so has to be placed correctly.

1101
07-09-2010, 12:15 PM
Each workstation:
Virus & spyware scan. Check AV logs
Check for P2P programs & signs of movie downloads etc.
Look at internet history in IE
Add remove: look at what been installed that shouldnt have

What was the internet data cap & actual usage for the month ??
wifi router ??

Chilling_Silence
07-09-2010, 01:40 PM
That's why Gargoyle would be ideal. Once a devices MAC address reaches a predefined quota over a predefined period of time, you can either completely kill all internet access to that device, or throttle them back to a speed of your choosing (For example, dial-up speeds).

Tomato / DD-WRT don't do that.

Cellux
07-09-2010, 02:40 PM
If you're willing to pay for a solution and are running ISA Server 2004/2006 I'd suggest TrafficQuota. http://www.digirain.com/en/trafficquota-overview.html

I personally use it at home to manage bandwidth usage applying caps once users have gone over their "limit". In depth reports. It's pretty awesome.

Can be configured per MAC Address, IP address, Usernames, workgroups etc.

utopian201
07-09-2010, 02:59 PM
That's why Gargoyle would be ideal. Once a devices MAC address reaches a predefined quota over a predefined period of time, you can either completely kill all internet access to that device, or throttle them back to a speed of your choosing (For example, dial-up speeds).

Tomato / DD-WRT don't do that.

You can do in dd-wrt with iptables (scripts which can be automatically generated if you don't know how to make them). Not as simple as gargoyle, but that is how gargoyle does it behind the scenes.

Chilling_Silence
07-09-2010, 03:03 PM
Ah ... Cool then! :)

utopian201
07-09-2010, 04:19 PM
there is also a simple script that you can run
google wrtbwmon
which lists which mac address (or computer name) used how much traffic.
I currently use this on my router at home

Chilling_Silence
07-09-2010, 06:33 PM
I stand corrected ;)