From owner-freebsd-questions@FreeBSD.ORG Sat Jan 3 06:00:13 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 53EA0106566B for ; Sat, 3 Jan 2009 06:00:13 +0000 (UTC) (envelope-from kurt.buff@gmail.com) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.172]) by mx1.freebsd.org (Postfix) with ESMTP id 285D38FC19 for ; Sat, 3 Jan 2009 06:00:12 +0000 (UTC) (envelope-from kurt.buff@gmail.com) Received: by wf-out-1314.google.com with SMTP id 24so8995694wfg.7 for ; Fri, 02 Jan 2009 22:00:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=Odm8jHzRJ5BjRMIhezHYkLQTm667ukoV30wLUL6DP5M=; b=qakJMMdCJyy87HJxwyenP+gm2N2NCMgtUpmQWduf71QEqjSEl1zRfsGHb0pgIGIi7X hcnvdi760Hw16O669VGVWGorcXpeNk2WdVR2Nur5YUfg4GdX+cCnclOfUg6YVjYuMNu7 ZwLx821vXVzZwKsy/kucDSnD6LfJGf4MSZrM8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=wVLicDDLt9DoyCoU4yI9EHLvBoRB7ndHNOTX7ETMfM98bm39RBemAAT6jY/g2HSN3Q nnyHrdUascCb/hLNhPgjd9r3UTVfDsQOF4mrel8IOqQXYwRcZUGf09ZfJSEfEUmDYcdW eiSowCOZY5FgUEs1UAUOMgxWwwvj3o1Z+P0iI= Received: by 10.142.207.8 with SMTP id e8mr7638995wfg.65.1230962412679; Fri, 02 Jan 2009 22:00:12 -0800 (PST) Received: by 10.142.101.7 with HTTP; Fri, 2 Jan 2009 22:00:12 -0800 (PST) Message-ID: Date: Fri, 2 Jan 2009 22:00:12 -0800 From: "Kurt Buff" To: "=?ISO-8859-1?Q?Sd=E4vtaker?=" In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: Cc: freebsd-questions@freebsd.org Subject: Re: Tool for traffic measure? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Jan 2009 06:00:13 -0000 On Fri, Jan 2, 2009 at 9:21 PM, Sd=E4vtaker wrote: > Hello, > I got a subnet with 5 machines and a cablemodem who provides 5 public ips > All is conected to a switch. > One of the machines is not ours and we want to check it is not > abuseing our internet link, so we want to know if there is any way to > monitor bandwich usage from one of the other machines in the subnet > with no need to modify the foreing machine config. Something like use > tcpdump in promiscuos mode or something like that, we doesnt matter > the content, we just need a bandwich conssumption meassure. > Thanks for any ideas. > Sdav You have several options: 1) If the switch has some intelligence, you can monitor it to measure bandwidth consumption. There are two ways to do this: a) if the switch implements SNMP, you can use mrtg (simple) or cacti (not so simple) to graph bandwidth on the switch by port and in total b) if the switch can mirror all of the data going across the switch to a port on the switch, you can use ntop to graph traffic. It only shows the top three bandwidth consumers at any given time, but i) it does have very nice graphing, and if the machine you are concerned about is consuming more than its fair share it will show, and ii) you can use standard bpf filters to capture utilization for just that box. 2) if you have a spare machine, you can put two NICs in it, and use it as a bridge between the switch and the router. This is a bit more complicated, but it allows you to implement either option 1a or 1b above. Kurt