What is the best way to monitor bandwidth consumtion for a small business?

[StraightPipe]

Edit: Solved: Used Netmeter on indiviual desktop to see who was using the bandwidth.

We've got a T-1 at work, and roughly 20 desktops working on it. We've also got Exchange server, Blackberry Enterprise Server, and a couple of offsite DVR's streaming security footage into our office.

Lately our connection has been really slow, and the ISP told us we're using between 1.2-1.5mbps during office hours...

I'd like to install some software on the webcam viewing desktops to see what they are eating up, plus my own desktop that's used for general surfing to see get a better picture of the problem.

I'm particularly interested in free solutions, because I dont want to alarm the owner by telling him we're using all our bandwidth. I'd rather find out where it's all going and cut the heavy users back.

We're an MS camp, running XP pro on desktops and 2003 Std on the servers. Our firewall is an old Watchguard 700.

 

[StraightPipe]

Well I found a few things in other forums and google. Seems NetFlow would be great (30 day trial), if we had a Cisco Equipment, but we're just using a bunch of dumb switches behind the firewall.

Ideally, I'd like some centralized application that can be loaded on a server to track the data on all the desktops. In particular I'm looking for a mbps consumed on each machine, and if possible a break down of what application was using it.

I'm no networking guru, but i do understand the basics of home networking...

 

[Modelworks]

You can look at wireshark. It will tell you every packet that goes in and out and what IP. It needs to be on a pc that all the computers traffic would pass through though.
http://www.wireshark.org/

Maybe set up a laptop to go in between. You would need two nics in it. A T1 shouldn't bog down a laptops network interface so it should work fine.

 

[StraightPipe]

How about an old Pentium 3 with 2 nics?

Do we just plug it in between our firewall and switch? How do we configure the network connections on the Wireshark box? Just bridge them? Do we need to make any special accomodations on that box, such as port forwarding, etc?

Thank so much. this seems like a great solution.

 

[brett42]

A quick and dirty solution would be to just use the windows built-in performance monitor (control panel, admin tools, performance). It allows you to add a bandwidth counter for each computer, assuming you know an admin password for each computer, so you can see how much each desktop is using at a given time. The main problem is that it is just a point in time monitor; it doesn't keep track of the total bandwidth used, but it might be good enough to see which computers are using the most bandwidth.

 

[jlazzaro]

wireshark is good at raw packet captures, but not so much for bandwidth monitoring. you can reassemble TCP streams and probobly find out the top offenders, but it isnt scalable and its difficult to use as a day-to-day monitoring tool.

Ntop sounds like the perfect solution for you.

 

[Engineer]

Jack recommended Netlimiter 2 Monitor (free). I've installed in on all of my PC's and have found several offenders that I did not know was even there (left over torrent transmissions that I thought that I had fully uninstalled, for example). It also comes in 32 and 64bit flavors.

Click me!

Although I'm not sure if it keeps any logs above the 24 hour (hour by hour) graphs.

Edit: Looks like it can keep todays, this weeks, this months, this years and multi year stats.

 

[Jamsan]

If the Watchdog supports SNMP, you can use PRTG to monitor one of the interfaces on it to get bandwidth consumption. You won't get individual PC usage, but you'll get overall bandwidth consumption to see if you're using what your ISP says you are.

Another option is to give Perspective from PacketTrap Networks a shot. It has a built in feature called ptFlow that emulates NetFlow/jFlow/sFlow etc, without the need for switches that support the functionality. It works much in the same way that Wireshark does (it would need to be running on a PC that all traffic hits before reaching the firewall), but it does a good job aggregating the data for you and not just looking at raw packets. It also gives source/destination information, so it's useful for figuring out what endpoints are the culprits of the bandwidth consumption.

Edit: To get the monitoring working, you can throw a hub between your firewall and main switch and put the PC with Perspective on that. It shouldn't slow the traffic to the internet down much at all. Does the firewall do any internal routing (is it a flat network do you have multiple subnets?) or is it strictly for passing traffic to the internet? If it's the latter, you should be fine to get a feel for what's happening and then disconnecting it. Aside from a hub, you can use a managed switch and enable port mirroring on it.

 

[Nothinman]

Something like ntop might do what you want if you can position the box running it in a place where it'll see all of your traffic. I don't know if Watchguards do NetFlow but if they do and if you have access to it you can setup a NetFlow back to a device on your network and have something capture/analyze it. Although most NetFlow tools aren't cheap or they require a lot of work on your end to setup properly.

 

[mooseracing]

Originally posted by: StraightPipe
Well I found a few things in other forums and google. Seems NetFlow would be great (30 day trial), if we had a Cisco Equipment,
.

Just an fyi, there is a free single interface Netflow product. I use it and love it.

We use SNMP (on the switches, routers, servers) with Cacti for easy viewing. You can also enable this on the desktop as well.

 

[n0cmonkey]

Free Netflow:
http://www.netflowdashboard.com
http://psyche.pontetech.com
ntop

Setting up a netflow device shouldn't be too difficult.

What kind of router do you have? Or does the ISP control everything beyond the firewall?

 

[StraightPipe]

Originally posted by: n0cmonkey
What kind of router do you have? Or does the ISP control everything beyond the firewall?

It's an Adtran Modem, but the ISP (Paetec) controls it.

Thanks for all the help. I ended up installing netmeter on several desktops and quickly got a feel for where the bandwidth was going (web cam viewers eating half our T-1).

thanks for everyone's help!