Solved

Monitor bandwidth of each computer on the network

Posted on 2006-10-26
16
655 Views
Last Modified: 2013-12-07
Hello,
  We have ADSL connection shared by 20 computers. I want to monitor bandwitdh usage of each computer or IP. Brand of the ADSL modem is AirTies but I do not know the model (if necessary I can learn). Modem supports SNMP and I know the password of the modem.
I can not install any software to each computer since they are not mine but I can install any software to my computer which can be open 24 hours/day.
I tried MRTG and PRTG but they showed total bandwidth usage. I suppose PRTG is able to do what I want but I do not know how to configure it (maybe OID is required but I did not see any OID in the control panel of the modem)

Thank you.
0
Comment
Question by:ozencozturk
  • 5
  • 5
  • 4
  • +1
16 Comments
 
LVL 7

Expert Comment

by:instillmotion
ID: 17815125
0
 
LVL 2

Author Comment

by:ozencozturk
ID: 17816067
I downloaded and installed ntop I think it is not what I want.
For example with PRTG I see that someone is using all bandwidth now. I want to learn which computer is downloading. with ntop, let alone identifying computer which is downloading, I cannot see that someone is downloading now. I think this is because ntop listens ethernet adapter to capture packets and analyze them. Since we use switch instead of hub in our LAN I do not get any other people's packets, so I cannot be aware of other computer's usage.
0
 
LVL 7

Assisted Solution

by:instillmotion
instillmotion earned 180 total points
ID: 17816116
you need to setup port mirroring on switch to redirect all ports to one port, or alternatively you can put a hub between your wan and gateway and put the ntop machine at that level.
0
 
LVL 2

Author Comment

by:ozencozturk
ID: 17816374
Then how can I find the IP address of the switch?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 17816558
What type of switch is it?  It must be a managed switched.  If it is a high end switch it may support Netflow.  If it does, you can setup NTOP to receive the Netflow data and setup the switch to send the netflow data to the box you are running Netflow on.

Doing a SNMP query on the modem will show you the total bandwidth used by the modem, as you have seen.

If you have a non-managed switch, you could enable SNMP on each computer and then use MRTG to query the computers directly.
0
 
LVL 2

Assisted Solution

by:dually681
dually681 earned 120 total points
ID: 17816635
really you need to monitor rthe quality of the traffic , so in that case setup syslog you can get the free syslog server from kiwi do a search on google for it and then install that on ur 24/7 pc and catch all the logs and review then to snoop on what they are up to. you need to setup ur dsl router or modem to send the syslog messages to your pc via ip address and enjoy all the good stuff youll be reading.


Enjoy,
Dually681
0
 
LVL 7

Expert Comment

by:instillmotion
ID: 17817314
What model is your switch.
0
 
LVL 2

Author Comment

by:ozencozturk
ID: 17823185
I learned the model of the switch and read the manual. In the 3rd paragraph of page five it says:
"The switch is plug-n-play without any software to configure and also fully compliant with all kinds of network protocols". We have 2 16-port switches behind the ADSL modem. Here is the information about them.

Model of the switches:  Ladox LD-1316-P
   Site: http://ladox.com/index.php?departman=urundetay&id=8
   Manual: http://biri.yonjasu.com/LD-1316-P_man.doc

Model of the modem: AirTies RT-110
   Site: http://www.airties.com/product_d.php?cid=1&id=48 (turkish)
   Features: http://www.airties.com/docs/rt110_ds_tr.pdf (3rd page, turkish)

giltjr>
 I searched for the word "Netflow" in the manual of the switch but it is not found. Maybe it does not support Netflow.
Moreover I cannot touch any other computer in the network.

dually681>
  I did not see any setting on the control panel of the adsl modem to send the syslog messages to my pc

 
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 7

Expert Comment

by:instillmotion
ID: 17823261
The switch wont' support Netflow or Port Mirroring. Your best bet is adding a HUB at the gateway.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 17823368
instillmotion is correct.  This is a non-mananged switch.  Only way to see the traffic is to connect the gateway, your switch, and a "monitoring" PC to a HUB.  You can run NTOP on the monitoring PC and it should give you everthing you need.
0
 
LVL 2

Author Comment

by:ozencozturk
ID: 17824856
Isn't it possible using SNMP protocol and the ADSL modem?
0
 
LVL 2

Expert Comment

by:dually681
ID: 17825315
my solution above works on a dsl modem/router or managed switch, so chances are you have one of the 3 with syslog message capacity.

Dually681
0
 
LVL 57

Accepted Solution

by:
giltjr earned 200 total points
ID: 17826105
No.  SNMP is what MRTG and PRTG uses.  SNMP can only give you the total amount of traffic going through the modem.

You can't get what each indvidual user is doing with it.

I am not sure 100% sure that Dually681 solution will work either.  It depends on what the modem (and the intergrated firewall) does log.  If it logs each indvidual connection and total traffic that was transfered on the connection, then using a syslog sever (such as Kiwi) you will see the informtion.  If the modem does not log indvidual connections you won't.  I can't read the documentation to know what the modem logs or does not log.

I know for sure that a HUB and NTOP will work as NTOP is designed to do exactly what you are asking.  All you need to do is get the traffic to the PC running NTOP.  

You would want:

                                                         Modem
                                                            /\
                                                             |
                                                            \/
   "your computers" <----> Switch <---> HUB
                                                            /\
                                                             |
                                                            \/
                                                         Monitoring PC running NTOP

                           
0
 
LVL 7

Expert Comment

by:instillmotion
ID: 17826430
ozencozturk, it doesn't look like your modem suports snmp trap. Basically what that means is that you can query the device but it cannot notify a management station where the syslog server would gather the data sent.

You won't regret setting up ntop, it's really quite easy and the results are worth it. If you need help with the setup let us know. giltjr's map is exactly what you need.
0
 
LVL 2

Author Comment

by:ozencozturk
ID: 17828356
I think modem supports snmp trap since there is a configuration of snmp trap in management interface. Here is the screenshot of this interface
http://img241.imageshack.us/img241/9498/snmptrapak3.jpg
I translated some parts of the interface. Note that it mentions notifying extraordinary events. Is there anything that we can do in this case?
 I understand your solution but in our situation we cannot apply that.

0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 200 total points
ID: 17828778
SNMP traps are a means to sending a message to another device when a "condition" or "event" takes place.

Monitorting how much bandwidth a specific IP address is using is not considered a condition or an event.
 
The page in your link is the page that use use to tell your modem the IP address of the computer that you want it to send the traps to.  You should have another configutation page that allows you to select which conditions/events will generate a trap.  If there is no page were you can select what conditions/events generate a trap, then the modem has predefined conditions/events and you can't select which ones you want.  In that situation the modem documentation should tell you want specific conditions/events will genertate traps.

Unless the firewall built into the modem monitors bandwidth utiltization by internal IP address and has SNMP mibs defined so you can query the modem or the modem reports this information through SYSLOG, you are going to have to setup some type of enviroment where something like NTOP can see all of the traffic.  With a non-managed switch, you are going to either need to get a hub or get a Ethernet TAP device.

0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Load balancing is the method of dividing the total amount of work performed by one computer between two or more computers. Its aim is to get more work done in the same amount of time, ensuring that all the users get served faster.
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now