From owner-freebsd-questions@FreeBSD.ORG Sat Jan 3 18:37:31 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 00C431065673 for ; Sat, 3 Jan 2009 18:37:31 +0000 (UTC) (envelope-from kurt.buff@gmail.com) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.175]) by mx1.freebsd.org (Postfix) with ESMTP id C52468FC14 for ; Sat, 3 Jan 2009 18:37:30 +0000 (UTC) (envelope-from kurt.buff@gmail.com) Received: by wf-out-1314.google.com with SMTP id 24so9163152wfg.7 for ; Sat, 03 Jan 2009 10:37:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=MNmDq3zXZpYNIQ+wFZiS1IWdq0hQDwzTFT1M8QLKCL0=; b=DPzh2O4ekj4hiRS5vnGT2tmaImirMyYxS5CxoL4hUU5nQLLXDRxOJDZyZlRKmAHkcG bQIf6BsiV46VDIUkwDn2iAeDceaV+1FI7fawSbpwle4Ssx5jcpvNnHLqEN6rvt3HpPtr fhejdGVTQEgIoXCg//3vhzIMfGcNrW+qf4mT4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=jk+NUnI9rbmezlDpMtp3QQ3v3Nzg61EGrnBx9pXKrmK79d0qjGLxyQfVKdMFfOYFW0 grg6wPHI/Gn7iiHU9ATwJRRniyeh82lr9zDmHz6hafWDjZht8pGnYZaXomk1dKZCDaQ1 U1oIP09U/uh285JJcTzgisVLExx+m6CiU3cjQ= Received: by 10.142.78.10 with SMTP id a10mr7858746wfb.270.1231007850371; Sat, 03 Jan 2009 10:37:30 -0800 (PST) Received: by 10.142.101.7 with HTTP; Sat, 3 Jan 2009 10:37:30 -0800 (PST) Message-ID: Date: Sat, 3 Jan 2009 10:37:30 -0800 From: "Kurt Buff" To: "=?ISO-8859-1?Q?Sd=E4vtaker?=" In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: Cc: freebsd-questions@freebsd.org Subject: Re: Tool for traffic measure? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Jan 2009 18:37:31 -0000 On Sat, Jan 3, 2009 at 8:03 AM, Sd=E4vtaker wrote: > Thanks for the info, i got a linksys SD208: > http://www.linksys.com/servlet/Satellite?c=3DL_Product_C2&childpagename= =3DUS%2FLayout&cid=3D1123638180923&pagename=3DLinksys%2FCommon%2FVisitorWra= pper&lid=3D8092322279B03 > It got 0 intelligence, right? > Thanks for the replies > Sdav > > On Sat, Jan 3, 2009 at 4:00 AM, Kurt Buff wrote: >> On Fri, Jan 2, 2009 at 9:21 PM, Sd=E4vtaker wrote: >>> Hello, >>> I got a subnet with 5 machines and a cablemodem who provides 5 public i= ps >>> All is conected to a switch. >>> One of the machines is not ours and we want to check it is not >>> abuseing our internet link, so we want to know if there is any way to >>> monitor bandwich usage from one of the other machines in the subnet >>> with no need to modify the foreing machine config. Something like use >>> tcpdump in promiscuos mode or something like that, we doesnt matter >>> the content, we just need a bandwich conssumption meassure. >>> Thanks for any ideas. >>> Sdav >> >> You have several options: >> >> 1) If the switch has some intelligence, you can monitor it to measure >> bandwidth consumption. There are two ways to do this: >> a) if the switch implements SNMP, you can use mrtg (simple) or >> cacti (not so simple) to graph bandwidth on the switch by port and in >> total >> b) if the switch can mirror all of the data going across the >> switch to a port on the switch, you can use ntop to graph traffic. It >> only shows the top three bandwidth consumers at any given time, but i) >> it does have very nice graphing, and if the machine you are concerned >> about is consuming more than its fair share it will show, and ii) you >> can use standard bpf filters to capture utilization for just that box. >> >> 2) if you have a spare machine, you can put two NICs in it, and use it >> as a bridge between the switch and the router. This is a bit more >> complicated, but it allows you to implement either option 1a or 1b >> above. >> >> Kurt Yes, the switch has zero intelligence. You'll either need another switch, or a spare PC with two NICs. Kurt