Find out network traffic per IP

Question

We have one central server which functions as an internet gateway. This server is connected to the internet, and using iptables we forward traffic and share the internet connection among all computers in the network. This works just fine.

However, sometimes internet gets really slow. Most likely one of the users is downloading videos or other large files. I want to pinpoint the culprit. I'm thinking of installing a tool that can monitor the network traffic that passes through the server, by IP. Preferably in real time as well as an accumulated total (again by IP). Any tool that is recommended for this? Preferably something in the Ubuntu repositories.

Answer 1

ntop is probably the best solution for doing this. It is designed to run long term and capture exactly what you're looking for.
It can show you which clients are receiving/sending the most traffic, where they're receiving/sending to, what protocols and ports are being used etc.
It then uses a web GUI to navigate and display this information.

ntop is a fairly well known tool, so I would be highly surprised if its not in Ubuntu's package repository.

Answer 2

To see realtime usage by IP (rather, by IP and port):

sudo apt install tcptrack
sudo tcptrack -i eth0

To see realtime usage by MAC address, a nice ncurses based tool is iptraf-ng:

sudo apt install iptraf-ng
sudo iptraf-ng

(And then, select "LAN station monitor → eth0".)

To see daily aggregate data volume by IP, my favourite is ipfm. Install with:

sudo apt install ipfm

Then configure in /etc/ipfm.conf according to man ipfm.conf and start with sudo ipfm.

Answer 3

ntop can give you exactly what you're asking for. It collects data about all the traffic flowing through your network (and can collect data from other networks if they have a device configured to send netfow data to your system).

It will show you every host on the network, with how much bandwidth they've used. It will let you drill down into each host and see what type of traffic they are generating and to/from whom. It will let you see currently established TCP connections. You can pretty much get lost for days going through the data it can give you.

The program can be a memory-hog, though, depending on how you have the options setup.

Answer 4

You can check the existing counters from iptables to see if anything looks out of line,

It is also possible to add accounting rules to iptables which are used only to generate traffic counts. A tool like Shorewall makes it easy to do this and has specific documentation on Accounting rules

There has been research showing that the large buffers in routers can cause performance problems. You may want to try shaping traffic to slightly less than the network capacity. Shorewall offers a couple of approaches to traffic shaping. This can also be used to prioritize certain kinds of traffic.

If you do identify a user whose bandwidth usage is excessive you have a few options:

• Discuss the issue with them and remind them of your usage policy;
• Block access to the service and/or site which is using the bandwidth;
• Limit traffic to the service and/or site which is using the bandwidth; and/or
• Limit traffic for the user in question.