Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

We have one central server which functions as an internet gateway. This server is connected to the internet, and using iptables we forward traffic and share the internet connection among all computers in the network. This works just fine.

However, sometimes internet gets really slow. Most likely one of the users is downloading videos or other large files. I want to pinpoint the culprit. I'm thinking of installing a tool that can monitor the network traffic that passes through the server, by IP. Preferably in real time as well as an accumulated total (again by IP). Any tool that is recommended for this? Preferably something in the Ubuntu repositories.

share|improve this question

3 Answers 3

up vote 7 down vote accepted

I'm going to have to be cheap and copy my answer from this question.

ntop is probably the best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you which clients are receiving/sending the most traffic, where theyre recieving/sending to, what protocols and ports are being used etc.
It then uses a web GUI to navigate and display this information.

ntop is a fairly well known tool, so I would be highly surprised if its not in Ubuntu's package repository.

ntop

share|improve this answer

You can check the existing counters from iptables to see if anything looks out of line,

It is also possible to add accounting rules to iptables which are used only to generate traffic counts. A tool like Shorewall makes it easy to do this and has specific documentation on Accounting rules

There has been research showing that the large buffers in routers can cause performance problems. You may want to try shaping traffic to slightly less than the network capacity. Shorewall offers a couple of approaches to traffic shaping. This can also be used to prioritize certain kinds of traffic.

If you do identify a user whose bandwidth usage is excessive you have a few options:

  • Discuss the issue with them and remind them of your usage policy;
  • Block access to the service and/or site which is using the bandwidth;
  • Limit traffic to the service and/or site which is using the bandwidth; and/or
  • Limit traffic for the user in question.
share|improve this answer

ntop can give you exactly what you're asking for. It collects data about all the traffic flowing through your network (and can collect data from other networks if they have a device configured to send netfow data to your system).

It will show you every host on the network, with how much bandwidth they've used. It will let you drill down into each host and see what type of traffic they are generating and to/from whom. It will let you see currently established TCP connections. You can pretty much get lost for days going through the data it can give you.

The program can be a memory-hog, though, depending on how you have the options setup.

share|improve this answer
2  
Bah, my answer has pretty pictures! Looks like we both answered at almost the exact same time. Oh well, have an upvote for the (all too true) memory comment :-) –  Patrick Apr 19 '12 at 1:11
1  
Excellent answer, also valid but I can only mark one. So I went with the timestamp to make my decision. Also, Patrick had a picture ;-) –  user Apr 21 '12 at 19:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.