15

I have a small (windows) network with a few people on it.

We have internet access via a BT router

Generally things are all fine, but occasionally, we seem to experience a dramatic loss of bandwidth.

I could be suffering from a zombie PC or a user running torrent software... Or I could simply have some kind of restriction being placed on my by my ISP?

I want to find out what is going on.

Is there a simple tool which I can run to give me a real world (Which Apps on Which PCs) are using all the bandwidth at any given point?

Rory Becker
  • 528
  • 6
  • 13

4 Answers4

4

I have used NetWorx to allow indiviual users to monitor their bandwidth use, and as it keeps good exportable logs it gives some useful statistics. Assuming the BT router you use supports it you can use PRTG or MRTG to actually monitor the usage on the WAN and possibly LAN ports.

Richard Slater
  • 3,228
  • 2
  • 28
  • 42
  • I use PRTG for exactly this purpose and it works very well - very easy to see at a glance how much bandwidth we've been using. Whether you can monitor individual LAN ports, however, depends on whether your router exposes counters for those ports. – Keithius Apr 30 '09 at 12:59
4

In our office we had similar problems and began using MRTG to monitor the individual network ports on our core network switch. We knew who was connected to each port through our wiring diagram, and quickly identified a couple of people who were using "extreme" amounts of bandwidth. It turns out they were streaming torrents from the office, and we quickly put a stop to that (to save bandwidth and prevent legal liability). We still had some issues and that was narrowed down to our core router. Everything else in the office had been upgraded to a fully switched 100Mbps network, but our core router that handles NAT routing, etc. was still an older 10Mbps Cisco router. We replaced that with a newer router and our connectivity problems evaporated. We still monitor our core switch for any problems, and it has helped to identify a few people running software they shouldn't be. Looking at the ports on your switch and the traffic flowing through them should give you a great place to start though (you'll need a switch the supports SNMP for that).

Justin Scott
  • 8,748
  • 1
  • 27
  • 39
  • 1
    i'd have a look why users can just install anything they want? – The Unix Janitor Feb 25 '11 at 13:34
  • That office environment was not your typical locked-down corporate prison; they were all pretty technical people (developers) who all brought in their own systems to work on (laptops), so they weren't using a domain with software installation restrictions or anything of that sort. Everyone was essentially their own administrator for their own box. – Justin Scott Mar 01 '11 at 00:10
1

What I use to diagnose these problems (ie, suddenly the bandwidth is being abused), I run iftop (http://www.ex-parrot.com/pdw/iftop/) on the router, if it's an unix machine. It provides you with a list of connections per interface per IP address which you can break down by port number.

So, this way you can find out what box is using most of the bandwidth, and if you have access to that box, correlating the port numbers on that box will let you know which process/application is abusive.

I know that's only valid if you are running a unix router, but pretty effective. For other setups, see other responses (like specialized hardware, snmp monitoring on the switches, etc)

golan
  • 134
  • 3
0

If your router does not support SNMP (most smaller "home" type routers don't), you can install DU Meter (http://www.hageltech.com/dumeter/about) which keeps daily/hourly statistics of traffic used. Install it on each PC and investigate when the problem occurs. It can even email you alerts if certain hourly threshold is bypassed (e.g. certain PC downloaded more than X megabytes during last 60 minutes, or today, or this month, etc.)

haimg
  • 631
  • 7
  • 14