Monitoring my bandwidth

[LuckyTaxi]

Enough is enough, I need to find out who keeps hogging our bandwidth in the office.
How can I go about finding the culprit? I have two Dell 48 port switches so I assume I have to put a box directly into the switch? Or do I put it on the firewall?

I have some *nix servers laying around so I prefer to use some open source software to accomplish this.

Thanks

 

[Crusty]

If you can do a port mirror, you can mirror your uplink ports on the switches to another port, hook up a linux/windows/whatever as long as it supports Wireshark and you'll be able to sniff the network traffic.

If you can not do that, then take the wan side of your firewall, drop it into a HUB(very important), uplink the hub to where your firewall wan was connected before and then put your network sniffing computer on the hub.

What firewall are you using btw?

 

[LuckyTaxi]

watchguard, i think my dell switch has a port mirror. I just downloaded iptraf and it looks like what I need.
Will work on switch side.

 

[Crusty]

It'll work IF you can setup the port mirroring. It's been a while since I've looked at a Watchguard, but I know you can bring up a console that shows all traffic going through the firewall via the Windows management tool, I'd also be willing to bet you can get a breakdown of network usage by device/mac address through their management tool.

 

[LuckyTaxi]

yes i see port mirroring on the dell switch. what if i have two switches? how they're linked together right now is as follows.

Firewall -> 1GB switch -> 48 port switch

Other 48port switch is uplink from 1gb switch as well

 

[Crusty]

Well ideally, you would do port mirroring on your gigabit for each of your switches uplink. That will also help you determine which user it is by eliminating 50% of them if the first switch you look at has low traffic.

 

[her209]

Use Netflow.

 

[LuckyTaxi]

ok makes sense, i wasnt sure if i could forward the packets from two ports to one. I shall try it in a bit.