Solved

Monitor Internet Access

Posted on 2006-11-21
3
151 Views
Last Modified: 2010-03-18
I have a client with 100 workstations on a Windows 2003 domain.  All Internet traffic goes through a PIX Firewall.  Between 10-11:30am their T-1 is maxed, after 11:30am the goes back down to normal usage of about 1/4 the T-1.  Is there a simple/easy way to monitor internet traffic and find out what internal IP address is using all the bandwidth?  I have put monitors on the switches in the building, but that shows total bandwidth including inside file transfers from file servers etc.  

0
Comment
Question by:TriYoung
3 Comments
 
LVL 48

Expert Comment

by:Jay_Jay70
Comment Utility
how much money do you want to spend? you can look at a proxy solution
0
 
LVL 9

Accepted Solution

by:
FixingStuff earned 125 total points
Comment Utility
You could use a packet/protocol analyzer to discover the high bandwidth users by IP.
Try www.ethereal.com it is free and well liked among net admins.
You will also need to setup the packet analyzer on a port that sees all your PIX traffic, in other words, not just any switch port.  You can place a hub in front of your inside interface of the PIX and connect your ethereal machine to the hub, or the more recommended method of a core switch that has port mirroring and connect your ethereal machine to the mirrored port.
I know this is not a real simple/easy way to monitor, but there is no simple/easy way that I know of. Hope this helps.
FS-
0
 

Author Comment

by:TriYoung
Comment Utility
Thank you for your help, I am goign to try ethereal.  I set it up and it looks like this will do the trick.  Thanks.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

The Need In an Active Directory enviroment, the PDC emulator provide time synchronization for the domain. This is important since Active Directory uses Kerberos for authentication.  By default, if the time difference between systems is off by more …
We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now