Monitor wireless bandwidth use...

[Ben_Stanton]

Hi guys,

I have a small wireless network with about 4 WAPs. These are connected directly to the router (with firewall and content filtering).

I want to be able to point the finger at a certain MAC address and say you have downloaded x amount of data. I can drop a small mini pc onto the network either cabled or wireless (in a secret location) to assist.

What software (preferably free) would be best to achieve this? I have cross-referenced MAC address' on the router table to that in the router log and can see where they are going, but not what exactly is being downloaded or how much. Also, not all device names show up in the table.

The 'culprits' have been warned by all manner of staff including SMT and the head. Yet, they still insist on downloaded in excess of 165GB over a month. Please bear in mind there is only ever around 15 of them at most.

Cheers

[Ben_Stanton]

Anybody?

I want to be able to point the finger at a particular MAC address(s) and say you have downloaded x amount of data.

Must be somebody out there that has done similar or knows how to?

Cheers

Ben

[DT2]

Why not lock down the firewall to only essential ports outbound? Bind his IP to MAC address and restrict it in the firewall to allow only port 80/443 outbound.
What firewall/filter are you using?

DT

[Gigabyte]

If your switch/router supports it you could use port mirroring on the port the AP is plugged into and monitor the traffic with maybe something like wireshark.

[DT2]

^^ That, but to be honest 165Gb a month is pure abuse of facilities, and certainly in contravention of every AUP I've ever seen.

DT

[Gigabyte]

^^ That, but to be honest 165Gb a month is pure abuse of facilities, and certainly in contravention of every AUP I've ever seen.

DT

As DT2 said, it is a bit ridiculous downloading that much in a month. If they are doing that much downloading it certainly begs the question of whether they are doing their jobs properly?

[Domino]

What about a little ntop box? ntop

Should be able to show you which client is doing what. Not that I've ever used one with wireless, but should be fine.

[pete]

I'm assuming you have a central choke point which the person has to go through, right? And said choke point is sufficiently well-designed to mirror a port without falling over.

So look at Ntop. ntop

Edit: that'll teach me to leave tabs open.

[Ben_Stanton]

Thanks guys. nTop downloaded. I'll give that a go

[m25man]

You might also look at wallwatcher or PRTG as SFlow and Netflow require your router or switch to support it.
SNMP support is more readily available.