Home / server / Questions / 307411
Accepted
Goro
Asked: 2011-09-02 15:06:11 +0800 CST

Monitor traffic by source/destination IP address

  • 772

I need to monitor traffic coming in and out of my server. Knowing the total in/out bandwidth is good, but ideally I would like to know how much traffic was sent to what address (we are talking about static IP addresses).

Is there a tool that would allow me to track bandwidth usage by destination/source?

Alternatively, can you recommend a good library or API for implementing such a functionality?

Note: At this stage I am looking for a Windows-based tool, but I would like to know of options available for any platform.

Thank you,

network-monitoring traffic-management bandwidth-control

5 Answers

  1. Best Answer

    Netflow is the end all, be all for this type of monitoring. While there are netflow tools for Windows, my favorite toolset is nfdump+nfsen on Linux/Unix for collection and web-based report generation respectively. I have found this toolset does everything I want, and they're free. As for collecting flows for later analysis with one of these tools, your router may support netflow export. If it doesn't, or if you don't have access to the router, you may configure your managed switch (if you have one) to mirror the ports you want to monitor to a dedicated monitoring port. Then you can use something like fprobe (also on Linux.) I recommend the pcap based fprobe over the ulog one because it was the easiest for me to get working.

    • 2

  2. Another interesting tool is ntop which will allow you to monitor all traffic. I've previously used it to analyze the traffic with good results. Is free software and you can use it on different OS (although Linux is preferred).

    • 2

  3. If you don't mind using a cool rocket-propelled grenade to hunt insects, it would be fairly quick to install Wireshark, maybe watch a video and set up a quick capture by interface. The Endpoints display will give you what you want, and there are many more ways to slice & dice. Remarkably usable despite its vast depth.

    • 1

  4. A Packet sniffer in PRTG, installed on the server, will give you the info you're looking for.

    http://www.paessler.com/manuals/prtg8/packet_sniffer_header_sensor.htm

    • 1

  5. In terms of basic tools I can think of two:

    ntop is a netflow / sFlow based tool that could integrate with other netflow tools.

    • 0