[SATLUG] monitoring network

[luis Garza]

Leif Johnson wrote:
>
> How can I monitor clients on my network that are streaming audio? They
> are gated through a FC6/iptables/NAT/proxy box. I've looked at netstat
> and iptstate, but I'm not sure what I'm looking for. I don't want to
> cut these users off (they're professional staff) but I want to see
> who's hogging the most bandwidth and maybe quietly squeeze them a bit.
>
> I guess what I'm asking is:
>
> 1. What should I look for w/ netstat?
>
> 2. How can I identify streaming audio with iptstate?
>
>
> Sincerely,
> Leif Johnson
> (361) 749-1200 x. 316
> http://blog.paisd.net
I think that you may want to check this list for similar requests. 

Basically, you have a user who is using a browser to go to a web site
with streaming audio.
Which means that the users app is using DNS to resolve the IP address
for the streaming audio site and your router is routing the connection
to the IP address. 

I believe that this list may have discussed DNS logging the the dangers
of slowing DNS with logging.
Also I think that squid can be used to "monitor" or log connections. 
Also snmp and mrtg could be used to monitor your traffic. 

I would set up snmp and mrtg to monitor the routed traffic.  I would
also install and monitor squid.

You may want to check them out.

Luis Garza