In a networked environment, such as SOHO, is there any tools that can monitor the network bandwidth usage based on the computer's IP or mac address? So that we can know which user has the highest bandwidth usage. If possible also come out statistics of each computer usage based on IP or mac address.

  • You forgot to mention your topology. What make is your router, what OS does it run, and are it's management capabilities?
    – tink
    Nov 9, 2012 at 1:04
  • tink, because I am not the person in charge of the network, but if I got the information about topology, I will explain it more. The OS is possibly any Linux, because I am looking for the solution.
    – Allen
    Nov 9, 2012 at 1:10
  • MRTG?
    – Mikel
    Nov 9, 2012 at 1:31
  • Mikel, I read from some resources, MRTG does not support source IP.
    – Allen
    Nov 9, 2012 at 4:31

4 Answers 4


There are various tools that can help, perhaps the most notable being iftop, which is probably available in the official repositories for your distribution. It reports per-IP bandwidth information through a curses interface using libpcap.

It accepts tcpdump-style arguments to modify its filter, for example, iftop -f "port http" filters to only include traffic ending up at port 80.


iftop for a top like interface for instant view.

ntop for a lot of statistics with a web interface

argus ditto with a CLI interface.

See also iptstate on Linux to get the information tracked by the connection tracker.


The iptables firewall can be used to achieve that.

It has byte and packet counts for each filter rule. So the idea is to make a filter rule for each IP on your network. As the iptables counts are not persistent (and overflow at 4GB), create a cron job to periodically read and reset the counters.


Add accounting tables for inbound and outbound traffic

iptables -N acct_in
iptables -N acct_out

Set the default rules (return to the parents)

iptables -A acct_in -j RETURN
iptables -A acct_out -j RETURN

For each client IP: Add an input and an output rule:

iptables -I acct_in -d 192.168.x.y
iptables -I acct_out -s 192.168.x.y

Finally append the acct_* chains to the FORWARD chain

iptables -A FORWARD -j acct_in
iptables -A FORWARD -j acct_out

This should be your basic iptables setup.

You can read the counter values using

iptables -v -L acct_in  # for inbound traffic
iptables -v -L acct_out # for outbound traffic 

... and reset the counters using

iptables -Z acct_in
iptables -Z acct_out

I'd recommend writing a script you run as cronjob to read and reset the counter values and to store them into a file. Use the -x flag to get the exact values that might be easier to process.

Alternatively I can recommend you to have a look at an old project of mine: nf_quota. I used it for a long time back when we had a 3GB/month traffic limit. It ran really stable but the code hasn't been updated in years...

It acts as netfilter plugin in the kernel. The downside is that you've got to compile it yourself.

The upsides are that the IPs are added automatically, you can even set per-ip or total-limits and that there's a neat command line tool to read the statistics.

/edit: I've just checked out the code myself and noticed that it doesn't compile with recent kernels as there's been some changes under the hood. So I recommend not using this project unless you know what you're doing (patches however are welcome ;) )


It sounds like that you need some monitoring at your gateway device. If you firewall/router is able to provide snmp data I would suggest using spiceworks or solar winds to collect the data that you need

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.