Network load monitoring

[TAMILVANAN]

Hi Folks,
I found a sudden increase of network load in my machine which is 4 times more than normal through the perfview.
I haven't add any application newly to my system.When I see through perfview there are no error packets or no congestion in the network.
I would like to know who are the user consuming how much bandwidth of the network and by processwise also which will enable me to idenify the problem.
So suggest some utility to find process,user based network bandwidth consumption or any HP-UX command which gives the network usage by processwise or userwise.

[Sebastian Galeski_1]

Hi try to use one of many network monitor like:
- netmon from WinNT

- go to www.netperf.org (netperf)

seba

[Steven Sim Kok Leong · Accepted solution]

Hi,

I don't think there is an easy way to do this. You will need to have:
1) a traffic monitor/sniffer tool
2) a port -> user matching tool
3) a script to integrate 1) and 2) and monitor over time

For 1), you can use ethereal (easiest to use) or tcpdump or as a last resort, HP-UX's native nettl. Measure the bytes transfer at specific time to specific service ports.

For 2), use lsof to monitor the owners of each socket opened on the server at specific times. You have to run lsof at periodic intervals as it only catches current state of sockets.

For 3), you will need to write a script. Either that or you have to perform the matching process manually.

Hope this helps. Regards.

Steven Sim Kok Leong

[TAMILVANAN]

Hi Steven,
Is there any price product like Glance, perfview which gives me the above mentioned metrics based on Network usage?

[T G Manikandan]

Hello,

Just check this site

www.ethereal.com
You can download some network monitoring tools which can monitor the network.

Thanks

[Adam Walter]

Snort is an open source and easily configurable packet sniffer that may be useful to you in tracking down sudden changes in network usage for individual stations.

[MANOJ SRIVASTAVA]

Hi TAMILVANAN


There are a lot of 3rd party porducts , depends on the maney you want to spend .


sysedge from Concord

Solarwinds from solarwinds.net



Manoj Srivastava

[Martin Johnson]

You can get some clues from perfview. Look at the Global Network Sumamry for high network utilitzation. Then do a "show/drill down/processes". Sending/receiving packets uses CPU. Look a the processes using CPU. If the process is currently running, you can use glance to look at the open files. This will show you if the process has an open socket. Armed with the user ID, you should be able to talk to the owner of the process and find out any recent changes.

This won't give you the smoking gun, but it usually points you in the right direction and does have the advantage of not having to install new software.


Marty

[Tim D Fulford]

I use Glance & Measure Ware which gives pkt/s, I then use the following perl script to find out how much info is in each packet (on average) I can't really take the credit for the perl I just modified from a previous answer for my purposes...

Tim

[Karthik S S]

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/netload-1.0.1/
-Karthik S S