Bandwidth usage - how can I find device causing it

[techie1982]

Hello

 

The school I support seem to be suffering from excessive bandwidth usage, leading to slow internet download speeds. Is there anyway I can trace the device causing it? I remember some software called "The Dude" a few years ago but don't know if it can be used for this. Stopping short of turning everything off and on one by one....

 

Regards

 

techie1982

[TechMonkey]

If you can mirror the port leading to your router then you can run wire shark on a machine from that and see what is being excessive. That is how we have done it before. Other option is if your proxy has an per user/device information. Smoothwall has a lovely set of graphs showing the top users by IP that we have used to track down constant streamers.

[techie1982]

Hi TechMonkey

 

As you can see from the cacti graph the school is hitting its 2MB limit and going over it quite alarmingly. I will try wireshark on the station I am on, will be good to find out what is causing this as I am struggling to update 2 iPads to IOS6 (760MB download from Apple).

 

[Geoff]

For general traffic If you have managed switches you can query them via SNMP and ask for their traffic counters. As long as you know what uses which switch port (and you should!) then it'd be fairly obvious (I have a Linux server running Cacti doing this here). Short of that, as above you need to mirror the port and monitor the traffic flows that way. If you main switch doesn't support mirroring then another option is have a machine setup as a layer 3 bridge and run some monitoring software on that (I've done this in the past with ntop on Linux).

 

If it's simply web traffic that's the issue (usually the only internet traffic a school network produces in any quantity due to how locked down LEA networks are) then you should be able to work out the usage from your web proxy logging.

[SchoolsBroadband]

Can your ISP not just tell you this? On the Fortinet devices we use its a piece of cake as you can see bandwidth by per IP address on your LAN and this easily shows which machine is the culprit and also what type of traffic they are using.

 

Otherwise SNMP monitor your switch ports as @Geoff recommends

[glennda]

How many devices do you have on your lan? 2mb could quite easily be hit IMHO but depends on the amount of users