How to isolate the source of high network utilization?

[Mladen Despic]

We sometimes experience unusually slow response
times between nodes on our network (as reported
by 'ping'). This is usually due to a high level of network
traffic, caused by another node. I would like to be
able to isolate the node that's causing the problem.
Furthermore, if possible, I would like to know what
kind of application (or port) is generating the traffic.

Can anyone suggest a (inexpensive) tool?
Any other creative troubleshooting thoughts?

[Karthik_2]

Mladen,
You can use measureware/PV to track the load on the nic cards.
There are few reasons for this sort of behaviour.
1.Backups -When u take backups over the network there will be a degrade in performance.
check cron to see if any backups are scheduled over this period.
2.Ftp file transfer of large files for batch processing.This also is mostly periodic.
3.Check if IP -forwarding is enabled.IP forwarding with a broadcast will cause momentarily high network traffic.
4.netstat -in and other few options will tell you the traffic by protocol .
5.It will also be a good idea to check if some network related daemons or running which is not required.

If your site is bit complex you can use network sniffers to get a bigger picture.

Cheers
Karthik...

[Philip Chan_1]

I used a tool call Linkview Pro for tackling problem like yours before. Through such program I was able to see the top sender/receiver over the network and the amount of traffic can be seem too. Do a search in www.download.com you may be able to find an evaluation copy of it.

If you got Openview then I think Net-Matrix should do the job for you too. One other free program I could think of is Ethereal, from what I know this one only gives you the raw data therefore you had to produce the summary report by yourselve.