[SATLUG] monitoring network

[Leif Johnson]

I installed ntop this morning and watched long enough to figure out who 
my bandwidth hogs were. Fortunately the network is geographically small 
enough that I could then walk to the indiviadual workstations and ask them 
throttle back a bit, especially at peak use times.

Sincerely,
Leif Johnson
(361) 749-1200 x. 316
http://blog.paisd.net

On Fri, 30 Nov 2007, Brad Knowles wrote:

> On 11/30/07, luis Garza wrote:
>
>>  Basically, you have a user who is using a browser to go to a web site
>>  with streaming audio.
>
> Indeed, that is likely.  Which specific protocol and/or port is being used to 
> stream the audio may be somewhat different, however.
>
>>  I believe that this list may have discussed DNS logging the the dangers
>>  of slowing DNS with logging.
>
> That can be a big issue, yes.
>
>>  Also I think that squid can be used to "monitor" or log connections.
>>  Also snmp and mrtg could be used to monitor your traffic.
>
> Squid isn't going to help you if the audio stream is done via RTSP, or other 
> non-HTTP protocol.  Using SNMP and mrtg (or other rrdtool-based system) on 
> the routers can help identify what's going on.
>
> But for the specific traffic in question, you may need to get down into the 
> weeds with tcpdump or WireShark, if higher level tools don't give you enough 
> information about what's going on.
>
>