+ Post New Thread
Results 1 to 11 of 11
*nix Thread, Cacti IP Accounting in Technical; Afternoon, We're suffering from saturation of our internet connection at various times during the day. We have Cacti monitoring the ...
  1. #1


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,689
    Thank Post
    352
    Thanked 795 Times in 714 Posts
    Rep Power
    346

    Cacti IP Accounting

    Afternoon,

    We're suffering from saturation of our internet connection at various times during the day.

    We have Cacti monitoring the HP Procurve switch port that connects to the router coming in and can accurately determine the current bits/s for our 10mbit line.

    We don't have access to the router on site (Affiniti) but whilst its all very useful for us to see our line is being shafted, it would be nice to see how much by which IPs over a period of time etc so we can narrow down whether anybody is being naughty or whatnot..

    Any advice would be gratefully received.

    Cheers.

    Kim.

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224
    Wrong tool. Use ntop on your firewall.

  3. Thanks to Geoff from:

    kmount (4th July 2008)

  4. #3


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,689
    Thank Post
    352
    Thanked 795 Times in 714 Posts
    Rep Power
    346
    Not an option sadly, we literally only have control from this end before the router/firewall is upstream.

    Thanks though

  5. #4

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224
    ok, put a linux box running as a layer 2 bridge inbetween your router and your network. Run ntop/iptraf/etc on that.

  6. Thanks to Geoff from:

    kmount (4th July 2008)

  7. #5

    GrumbleDook's Avatar
    Join Date
    Jul 2005
    Location
    Gosport, Hampshire
    Posts
    9,932
    Thank Post
    1,339
    Thanked 1,781 Times in 1,105 Posts
    Blog Entries
    19
    Rep Power
    594
    Posted via Mobile Devicesnoop on your network to sample the traffic.

    Are you looking at the originating addresses within your own lan that are killing things?

  8. Thanks to GrumbleDook from:

    kmount (4th July 2008)

  9. #6


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,689
    Thank Post
    352
    Thanked 795 Times in 714 Posts
    Rep Power
    346
    Basically, I can see the switch port being shafted but have not done anything further.

    I'm trying to see how much is coming through the particular switch port TO where on our internal network.

    Cheers.

  10. #7
    robk's Avatar
    Join Date
    Nov 2005
    Location
    Ashbourne
    Posts
    692
    Thank Post
    172
    Thanked 128 Times in 107 Posts
    Blog Entries
    1
    Rep Power
    47
    If its a procurve switch you could enable port mirroring on the router port and a pc connected to a monitoring port. This would allow the pc to see all the traffic going to and from the router (think hub v switch on those two ports).

    Running wire shark on the pc at the times you are getting hammered would show you the source and destination of all the packets. Lots of data, but it would be there.

    RobK

  11. Thanks to robk from:

    kmount (4th July 2008)

  12. #8

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224
    You will need quite a beefy machine to keep up with the traffic too.

  13. #9


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,689
    Thank Post
    352
    Thanked 795 Times in 714 Posts
    Rep Power
    346
    How beefy realistically?

    Thanks

  14. #10

    GrumbleDook's Avatar
    Join Date
    Jul 2005
    Location
    Gosport, Hampshire
    Posts
    9,932
    Thank Post
    1,339
    Thanked 1,781 Times in 1,105 Posts
    Blog Entries
    19
    Rep Power
    594
    I had Scrutenizer recommended to me earlier today for traffic analysis.
    Traffic Monitoring with Scrutinizer NetFlow & sFlow Analyzer form plixer International

    Might be worth a try by using the 30 day demo.

  15. #11

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224
    Quote Originally Posted by kmount View Post
    How beefy realistically?

    Thanks
    Anything built within the last three years should be fine. Just bump up the ram to 2Gb. Also make sure you use decent network cards. I'd suggest the intel ether express 100 or 1000, dependant on your line speed.

SHARE:
+ Post New Thread

Similar Threads

  1. Bulk edit graph tree - Cacti
    By Joedetic in forum Wireless Networks
    Replies: 2
    Last Post: 10th June 2008, 06:14 PM
  2. Suggestions for EduGeek Cacti Guide
    By Geoff in forum Wireless Networks
    Replies: 18
    Last Post: 22nd May 2008, 04:24 PM
  3. Online Accounting : One for self-employed
    By contink in forum General Chat
    Replies: 0
    Last Post: 12th May 2008, 03:37 PM
  4. Microsoft Office Accounting 2008
    By zag in forum MIS Systems
    Replies: 2
    Last Post: 25th March 2008, 02:23 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •