 beachintechThere's sand in my tool bagPremium
join:2008-01-06
kudos:5
 ·Comcast
1 edit | Monitoring Bandwidth/Traffic Inline in K12 setting Here's the scenario, I want to find something that will work with a K12 budget (read none) and allow me to monitor traffic in a building with an inline PC running *nix/windows 2k8r2/etc. I would like it to be open source if at all possible. We don't do a lot of bandwidth monitoring currently and need to step up our game so to speak. Please ask any questions you may have and I welcome any suggestions with what you have experience with.
This would be in a building with about 1000 users, 800 machines. I am going to start with my office of about 80 people, about 150 devices. 10/10 meg TLS circuit.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer. |
|
| What are you using as a router (what does the circuit terminate at?) and what kind of switches do you have?
Are you looking to see if a client is using-up the bandwidth or are you looking to see, what the clients are doing (aka packet sniffing)? |
|
|
|
 RobIn Deo speramus.Premium
join:2001-08-25
Kendall, FL
kudos:3 | reply to beachintech
For bandwidth monitoring, you can use MRTG, or even pfSense. |
|
| reply to beachintech
A 2nd vote for MRTG.
A Windows-based solution I've used at home is PRTG; their demo version includes a 10 "sensor" limit to it if you
want to play around.
What equipment is in place, and what do you want to monitor? Just bandwidth, or do you want to break it down
into flows (ie. x% FTP, y% HTTP, z% SMTP). Are you also looking into uptimes as well?
I'd also get a good syslog server set up as well.
Regards |
|
beachintechThere's sand in my tool bagPremium
join:2008-01-06
kudos:5 Reviews:
·Comcast
| reply to VVSneakEh
Terminates to a Cisco 3750 and the rest of the network is a mix of 2960's and a few other Cisco models.
I would like to see what device is using the bandwidth, not so much monitoring yet. Breaking it up in to flows would be nice, but not necessary, uptimes are not that important for this project.
Thanks all.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer. |
|
 PaulgDisplaced YooperPremium
join:2004-03-15
Neenah, WI
kudos:1 | Unfortunately, those Cisco models don't support net flow. What is providing firewall services? |
|
beachintechThere's sand in my tool bagPremium
join:2008-01-06
kudos:5 | We are part of a state wide network, so we don't have anything providing firewall services at each location, it's provided farther upstream out of my scope.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer. |
|
 exocet_cmI am the law - Judge DreddPremium
join:2003-03-23
New Orleans, LA
kudos:2 | You could setup Untangle firewall in transparent bridge mode and monitor bandwidth and a host of other items such as content, etc. It is free and you only need a small box and two NICs.
For testing purposes any box would probably suit your needs. If you want to keep it permanent you probably should look into server system hardware.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com |
|
| said by exocet_cm:You could setup Untangle firewall in transparent bridge mode and monitor bandwidth and a host of other items such as content, etc. It is free and you only need a small box and two NICs.
For testing purposes any box would probably suit your needs. If you want to keep it permanent you probably should look into server system hardware.
i am not trying to thread jack, but i am looking to do the same thing. i want to monitor bandwidth by ip/device on my network.
i currently use pfsense as the main router and i can see the WAN usage, but not sure if i can monitor by ip/device with pfsense.
are you saying i could setup untangle between pfsense (or any router/gateway) and my switch and see more granular bandwidth info? |
|
exocet_cmI am the law - Judge DreddPremium
join:2003-03-23
New Orleans, LA
kudos:2 | 
Live traffic view | 
Live session view | 
Reports | 
Reports |  |  |
This is one of my Untangle boxes in router mode (don't have any in bridge mode at the moment). You can view live traffic by adding a rule to the firewall module and monitoring a specific port by enabling "logging", there is a session mode to view current sessions, and you can look at archived reports or generate reports on the fly to view data.
You also have the option to export to excel .csv if you want to create a custom pivot table to dig through data (if you need control at that granular level).
It might be what you are looking for. Best part is that it is free.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com |
|
| looks good. i might look into this.
can you confirm that i can set this in between my pfsense box and network switch? |
|
exocet_cmI am the law - Judge DreddPremium
join:2003-03-23
New Orleans, LA
kudos:2 | said by tomdlgns:looks good. i might look into this.
can you confirm that i can set this in between my pfsense box and network switch?
I can't confirm but I don't see why not.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com |
|
| when you set untangle to bridge mode, do you have to do any other configuration or is one nic in and the other nic out? |
|
exocet_cmI am the law - Judge DreddPremium
join:2003-03-23
New Orleans, LA
kudos:2 | said by tomdlgns:when you set untangle to bridge mode, do you have to do any other configuration or is one nic in and the other nic out?
That is pretty much the gist. Check out these resources:
Download: »www.untangle.com/store/get-untangle
Bridge mode FAQ: »wiki.untangle.com/index.php/Intr···dge_Mode
Installation forum: »forums.untangle.com/installation/
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com |
|
| ok, i will check that out, thanks.
i installed untagle a few years ago so i am a little familiar with the setup, but never stuck with it or looked at the bridge mode option. |
|
beachintechThere's sand in my tool bagPremium
join:2008-01-06
kudos:5 | reply to exocet_cm
Thank you for that, I actually had that same solution in my list and glad to see someone else bring it up.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer. |
|
| reply to Paulg
Was going to ask "are you sure about that," but then I dug up a few articles indicating the 3750s only track the 1st packet of the flow,
and the 29xx series switches will only do SNMP load-based polling.
@beachintech
Really dumb question, are they 3750s, 3750Gs, or the newer 3750Xs?
Do you have access to any other layer3 device within the network _IF_ Netflow or similar was needed?
Tell me I'm not crazy when I read this article that the 3750X has an addin module that does NetFlow -- »www.plixer.com/blog/netflow/cisc···support/
Regards |
|
PaulgDisplaced YooperPremium
join:2004-03-15
Neenah, WI
kudos:1 | Yes, the 3750X has an uplink module (PN: C3KX-SM-10G) that provides netflow, but only on the two uplink ports. |
|
| reply to beachintech
Do you want content filtering too or just monitoring? There are quite a few options targeted at the K12 space (cost some $), but they do more then just monitor traffic.
--
How lucky am I to have known someone who is so hard to say good-bye to. |
|
