Tools that monitor the network bandwidth based on IP?

Question

In a networked environment, such as SOHO, is there any tools that can monitor the network bandwidth usage based on the computer's IP or mac address? So that we can know which user has the highest bandwidth usage. If possible also come out statistics of each computer usage based on IP or mac address.

Answer 1

iftop for a top like interface for instant view.

ntop for a lot of statistics with a web interface

argus ditto with a CLI interface.

See also iptstate on Linux to get the information tracked by the connection tracker.

Answer 2

There are various tools that can help, perhaps the most notable being iftop, which is probably available in the official repositories for your distribution. It reports per-IP bandwidth information through a curses interface using libpcap.

It accepts tcpdump-style arguments to modify its filter, for example, iftop -f "port http" filters to only include traffic ending up at port 80.

Answer 3

The iptables firewall can be used to achieve that.

It has byte and packet counts for each filter rule. So the idea is to make a filter rule for each IP on your network. As the iptables counts are not persistent (and overflow at 4GB), create a cron job to periodically read and reset the counters.

Steps:

Add accounting tables for inbound and outbound traffic

iptables -N acct_in
iptables -N acct_out

Set the default rules (return to the parents)

iptables -A acct_in -j RETURN
iptables -A acct_out -j RETURN

For each client IP: Add an input and an output rule:

iptables -I acct_in -d 192.168.x.y
iptables -I acct_out -s 192.168.x.y

Finally append the acct_* chains to the FORWARD chain

iptables -A FORWARD -j acct_in
iptables -A FORWARD -j acct_out

This should be your basic iptables setup.

You can read the counter values using

iptables -v -L acct_in  # for inbound traffic
iptables -v -L acct_out # for outbound traffic 

... and reset the counters using

iptables -Z acct_in
iptables -Z acct_out

I'd recommend writing a script you run as cronjob to read and reset the counter values and to store them into a file. Use the -x flag to get the exact values that might be easier to process.

---

Alternatively I can recommend you to have a look at an old project of mine: nf_quota. I used it for a long time back when we had a 3GB/month traffic limit. It ran really stable but the code hasn't been updated in years...

It acts as netfilter plugin in the kernel. The downside is that you've got to compile it yourself.

The upsides are that the IPs are added automatically, you can even set per-ip or total-limits and that there's a neat command line tool to read the statistics.

/edit: I've just checked out the code myself and noticed that it doesn't compile with recent kernels as there's been some changes under the hood. So I recommend not using this project unless you know what you're doing (patches however are welcome ;) )

Answer 4

It sounds like that you need some monitoring at your gateway device. If you firewall/router is able to provide snmp data I would suggest using spiceworks or solar winds to collect the data that you need