Bandwidth management

[Chris Bedford]

I don't even know where this question should be posted, this seems the closest forum. Maybe ITRC isn't even the right place, but I'm sure with all the experience and intelligence represented here *someone* must be able to give me some suggestions.

I need to be able to monitor bandwidth usage on a per-user basis - probably only for a month - but haven't been able to find a single package that can do that. For instance, WebMarshal has excellent reporting, as long as all user traffic is web based, but it is unable to tell me how much data has been transmitted using POP3 / SMTP.

Isn't there some way of simply tracking "total bytes between PC 'x' and the Internet"? The emphasis is on "simply" here, since the whole reason for wanting to monitor Internet usage is because this is a small business, and we pay per GB for DSL bandwidth in this part of the world - no way around it - it's quite expensive and adds up fast when you go have a data "cap" of 20 GB for the month and regularly go through that limit before the 15th - last month's total usage was 54 GB, in an office where there are only 11 users!

We are running a linux based firewall / router and a Microsoft SBS domain, so regulating which machines have access to the outside world would not be an issue and I at first thought some form of proxy server wuold be the answer, but the whole email thing seems to torpedo that concept.

Any ideas? Should I move this to a different forum?

Chris

[Mohammed Faiz]

Hi,

I'm afraid the only things that I know of that do this well are appliances like netenforcer or packetshaper which are an expensive option for a small office.
My initial thought would be that for a total of 11 machines it may be best to look at a software tool that runs on each local client.
Other options are to monitor bandwidth usage on individual ports on your switches with something like cacti (open source) but that doesn't tell you the source/destination IPs of the traffic.
If your switches support sflow that's another option (that does show you IP info) but it's more of a real-time tool and so the software tools that I have seen for it are not the best for longer term trending.

[Mohammed Faiz]

One option that I forgot about was pfsense (an off-shoot of monowall):

http://doc.pfsense.org/index.php/Main_Page

I can't comment on it myself as I haven't ever installed it but I've heard good things about it.

[Chris Bedford]

Thanks Mo,

Options worth looking into. Seems every suggestion I have come across requires spending of $$$, or lots of time, or both - it is going to be interesting just doing the reading to get some sort of comparative idea. But of course the proof of the pudding is always in the installing, because that's when the unforeseen "gotchas" come out!

All the best
Chris

[Tim Maxwell]

You might give this a try.
http://www.mikrotik.com/thedude.php
If you're using managed switches it can collect the snmp data and you can set up graphs for each port. Best part is that it's free.
Tim