Detecting Bandwidth Abusers

Using ethereal or Windows Network Monitor, what's the technique for
finding the largest bandwidth suckers on a subnet?

I would say neither would work well except for maybe monitoring a particular
server. For internet access your firewall device may be able to list users
by bandwidth [not all do] or if you have a managed switch you may be able to
see what port traffic is. I can see that easily with my HP Procurve
512. --- Steve


"Google Mike" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) m...
> Using ethereal or Windows Network Monitor, what's the technique for
> finding the largest bandwidth suckers on a subnet?

Steven L Umbach wrote:
> I would say neither would work well except for maybe monitoring a
particular
> server. For internet access your firewall device may be able to list
users
> by bandwidth [not all do] or if you have a managed switch you may be
able to
> see what port traffic is. I can see that easily with my HP Procurve
> 512. --- Steve
>
>
> "Google Mike" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) m...
> > Using ethereal or Windows Network Monitor, what's the technique for
> > finding the largest bandwidth suckers on a subnet?

Shouldn't promiscuous mode in Windows Network Monitor or Ethereal
provide me statistics for a point of time on a subnet? And from those
statistics, how do I read them to find the largest bandwidth suckers?
In particular I'm interested in:

* People who abuse our net policy and download video or audio in Flash
MX, Windows Media Player, or Real.
* People who download stuff from FTP or HTTP that is over 9MB.
* Other major traffic going on with the subnet, such as someone
inadvertantly loaded NetBEUI or the subnet has some crazy master
browser election process going on with the Windows boxes.

I use both occasionally to analyze traffic between computers but don't know
of a good way to use either as a bandwidth monitor for the network,
particularly in a switched environment. It can provide information for
traffic to and from a particular computer and of course you will see all
broadcasts on the network. A managed switch is a much better option - if you
have one. What may help is to enable performance monitor on your computers
which can graph usage for a number of network parameters on each computer
you monitor and that can be done remotely assuming you have admin rights on
the remote computer. There are products that claim they can work with your
switch such as the one I found below in a Google search and it has a free
thirty day trial. I have not used it myself so I can not comment on how well
it works. --- Steve

http://www.netlatency.com/solutions/...monitoring.asp
http://techrepublic.com.com/5100-6270-5025576.html -- performance monitor
http://www.microsoft.com/serviceprov...rt/perfmon.asp -- example of
performance monitor deployment

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
>
> Steven L Umbach wrote:
>> I would say neither would work well except for maybe monitoring a
> particular
>> server. For internet access your firewall device may be able to list
> users
>> by bandwidth [not all do] or if you have a managed switch you may be
> able to
>> see what port traffic is. I can see that easily with my HP Procurve
>> 512. --- Steve
>>
>>
>> "Google Mike" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed) m...
>> > Using ethereal or Windows Network Monitor, what's the technique for
>> > finding the largest bandwidth suckers on a subnet?
>
> Shouldn't promiscuous mode in Windows Network Monitor or Ethereal
> provide me statistics for a point of time on a subnet? And from those
> statistics, how do I read them to find the largest bandwidth suckers?
> In particular I'm interested in:
>
> * People who abuse our net policy and download video or audio in Flash
> MX, Windows Media Player, or Real.
> * People who download stuff from FTP or HTTP that is over 9MB.
> * Other major traffic going on with the subnet, such as someone
> inadvertantly loaded NetBEUI or the subnet has some crazy master
> browser election process going on with the Windows boxes.
>

"Steven L Umbach" <(E-Mail Removed)> wrote in message
news:%23TA%(E-Mail Removed)...
> I use both occasionally to analyze traffic between computers but don't
know
> of a good way to use either as a bandwidth monitor for the network,
> particularly in a switched environment. It can provide information for

Me either. Bandwidth monitors I've seen are specific applications designed
exactly for that purpose. They must be loaded specifically on the machine
being monitored unless they have some sort of "agent" that can be loaded on
other machines. The "agent" may not be needed on a "hubbed" network.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com