Hi guys,
How can I monitor someone network bandwidth usage within an organization? Lately, I noticed that someone is draining out our internet. Could you suggest a few ways to do this, to trace which user is using a lot of bandwidth? Thanks.
27 comments · 70% upvoted · other discussions
Netflow would be great in this case.
Netflow.
old school, but enable SNMP monitoring on your switches and setup MRTG. you can get a graph per switchport.
Netflow and or LibreNMS with leveraging SNMP with your clients. Set LibreNMS as a static and then configure your clients to it using GP if you are windows environment.
You might see if PRTG can detect that on your router.
What do you have in your infrastructure? Any firewalls?
Btw, I am using Untangle
Netflow is the correct mid-long term answer.
Short term, you could use PRTG to monitor the network adapters bandwidth usage of each computer in the LAN. You could configure alerts to email you if someone uses > 30Mbps for longer than 30 sec. You could have a PRTG environment setup in a couple hours. The free version gives you 100 free sensors but obviously read the T&C to see if corporate usage is allowed.
I've used capsa in the past. Just need to put it on a mirrored switch port. Free trial is all that's needed.
https://www.colasoft.com/capsa/
Another product that is open source.
added to my list, thanks
You can use observium via snmp to monitor network traffic. In terms of monitoring flows it depends on what switches you have some have netflow while others do sflow
I think most monitoring software like Nagios and SolarWinds have this option.
Check what reporting/logging you have on your firewall.
We (Obkio) can help you with Network Performance Monitoring. We don't capture user traffic so we won't tell you which device is using the bandwidth but we monitor end-to-end performance to help identify issues before they affect end-user. Anyway, if you have any questions, I am available to help. 👍
What firewalls are you using? We have a few ASA 5510s and 5516s, they have some pretty good outputs of things like bandwidth usage, and source and destination IP addresses. I use it regularly to find out who's raping our internet connection.
I am using Untangle
Thanks for the detailed and well thought out response.
You've given me absolutely no useful information there. Are you using one of their appliances? Are you running it as a virtual appliance?
Build: 9.3.2~svn20121030r33425release9.3-1lenny
Kernel: 2.6.26-2-untangle-amd64
I give up.
It is not a virtual firewall, btw.
Nope, I’ve given up. I’m putting as much thought into my responses as you are.
None.
Have you looked at your gateway/router’s web GUI to see if there’s a way to monitor bandwidth through it? Might be easier, but you may have tried that or want something more.