Bandwidth monitor and grapher

Hello,
There is a device out there called a Packeteer (sp?). It is a
transparent network device that monitors the flow of traffic and makes
graphs/reports of how much bandwidth was used each hour, what
ports/applications used what bandwidth, etc.

I would like to make a device like this in Linux. I have setup bridges
before in Linux, so that is how I would make it transparent, but from a
software side I am lost.

Any ideas?

-Scott

In comp.os.linux.networking darktiger <(E-Mail Removed)>:
> Hello,
> There is a device out there called a Packeteer (sp?). It is a
> transparent network device that monitors the flow of traffic and makes
> graphs/reports of how much bandwidth was used each hour, what
> ports/applications used what bandwidth, etc.

This direction -> http://www.ntop.org/

Just run it in webmode. ;-)

[..]

--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
#bofh excuse 340: We'll fix that in the next (upgrade, update,
patch release, service pack).

darktiger wrote:
> Hello,
> There is a device out there called a Packeteer (sp?). It is a
> transparent network device that monitors the flow of traffic and makes
> graphs/reports of how much bandwidth was used each hour, what
> ports/applications used what bandwidth, etc.
>
> I would like to make a device like this in Linux. I have setup bridges
> before in Linux, so that is how I would make it transparent, but from a
> software side I am lost.
>
> Any ideas?
>
> -Scott
>

ntop will give you much of the information that packeteer gives,
although it's not as well presented, nor (I think) does it have
configurable traffic classes like packeteer.

Packeteer's main frature is being able to regulate bandwidth
usage and priority according to traffic class. ntop cannot do
that, and I don't think any linux feature can do as well as
packeteer does. Packeteer's analysis and graphing is really just
an add-on so you can easliy see the traffic shaping working.

But if it's usage stats you're after, give ntop a try. It
certainly gives some fascinating information.

darktiger wrote:
> Hello,
> There is a device out there called a Packeteer (sp?). It is a
> transparent network device that monitors the flow of traffic and makes
> graphs/reports of how much bandwidth was used each hour, what
> ports/applications used what bandwidth, etc.
>
> I would like to make a device like this in Linux. I have setup bridges
> before in Linux, so that is how I would make it transparent, but from a
> software side I am lost.
>
> Any ideas?
>
> -Scott

There is a packeteer-like commercial quality add-on for linux:

www.etinc.com

Thank you all for your responses! I will give ntop a try.

Check out MRTG:

http://www.ee.ethz.ch/~oetiker/webtools/mrtg/

It's very good and widely used.

If you want to regulate bandwidth like the Packeteer, then use iptables
and tc. You can do allmost anything you want (QoS, bandwidth limiting,
etc etc), check out:

http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/index.html

Good luck!

Tobias Skytte

Thanks! The biggest thing I care about it application classification
and how much BW each application is using.

I notice that I can download Layer 7 classifications for netfilter,
hmm...

I would like to see which applications are using the most bandwidth, ie
www or Kazza. Is someone on the network playing Battlefield 2 or is all
the traffic WWW/SMTP/POP3, etc.

ntop is awesome, but for applications it does not know, it just lists
"unknown". So I now have to look and see if I can use the layer 7
package for netfilter, and integrate it into ntop.


As for mrtg, since it use SNMP and such the polling rate is too slow.

Ok, to be able to classify bw usage like that you have to monitor the
various ports. But you can still use MRTG for that! You don't *have* to
use SNMP with MRTG, anything can be used as the input. F.ex. I'm
graphing the current dial-in count, amount of mails in the mailqueue,
etc. as well as SMTP bw rate, signal-noise ratio on my sat-dish etc.
etc.

To graph www, SMTP, pop3 or kazaa usage mark the packets with iptables,
then put it into different qdiscs with tc then graph it with MRTG. Not
super easy to do, but doable.
You use the output of 'tc -s qdisc' f.ex. as input to MRTG.

If the polling rate is too slow (5 min default) you can just change it
to pretty much anything you want.

Good luck!

Tobias Skytte