dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1510
share rss forum feed


beachintech
There's sand in my tool bag
Premium
join:2008-01-06
kudos:5

1 edit

Monitoring Bandwidth/Traffic Inline in K12 setting

Here's the scenario, I want to find something that will work with a K12 budget (read none) and allow me to monitor traffic in a building with an inline PC running *nix/windows 2k8r2/etc. I would like it to be open source if at all possible. We don't do a lot of bandwidth monitoring currently and need to step up our game so to speak. Please ask any questions you may have and I welcome any suggestions with what you have experience with.

This would be in a building with about 1000 users, 800 machines. I am going to start with my office of about 80 people, about 150 devices. 10/10 meg TLS circuit.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer.


VVSneakEh

join:2003-02-17
Toronto, ON
What are you using as a router (what does the circuit terminate at?) and what kind of switches do you have?

Are you looking to see if a client is using-up the bandwidth or are you looking to see, what the clients are doing (aka packet sniffing)?


Rob
In Deo speramus.
Premium
join:2001-08-25
Kendall, FL
kudos:2
reply to beachintech
For bandwidth monitoring, you can use MRTG, or even pfSense.

HELLFIRE
Premium
join:2009-11-25
kudos:19
reply to beachintech
A 2nd vote for MRTG.

A Windows-based solution I've used at home is PRTG; their demo version includes a 10 "sensor" limit to it if you
want to play around.

What equipment is in place, and what do you want to monitor? Just bandwidth, or do you want to break it down
into flows (ie. x% FTP, y% HTTP, z% SMTP). Are you also looking into uptimes as well?

I'd also get a good syslog server set up as well.

Regards


beachintech
There's sand in my tool bag
Premium
join:2008-01-06
kudos:5
reply to VVSneakEh
Terminates to a Cisco 3750 and the rest of the network is a mix of 2960's and a few other Cisco models.

I would like to see what device is using the bandwidth, not so much monitoring yet. Breaking it up in to flows would be nice, but not necessary, uptimes are not that important for this project.

Thanks all.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer.


Paulg
Displaced Yooper
Premium
join:2004-03-15
Neenah, WI
kudos:1
Unfortunately, those Cisco models don't support net flow. What is providing firewall services?


beachintech
There's sand in my tool bag
Premium
join:2008-01-06
kudos:5
We are part of a state wide network, so we don't have anything providing firewall services at each location, it's provided farther upstream out of my scope.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer.


exocet_cm
Free at last, free at last
Premium
join:2003-03-23
New Orleans, LA
kudos:3
You could setup Untangle firewall in transparent bridge mode and monitor bandwidth and a host of other items such as content, etc. It is free and you only need a small box and two NICs.

For testing purposes any box would probably suit your needs. If you want to keep it permanent you probably should look into server system hardware.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com

tomdlgns
Premium
join:2003-03-21
Chicago, IL
kudos:1
said by exocet_cm:

You could setup Untangle firewall in transparent bridge mode and monitor bandwidth and a host of other items such as content, etc. It is free and you only need a small box and two NICs.

For testing purposes any box would probably suit your needs. If you want to keep it permanent you probably should look into server system hardware.

i am not trying to thread jack, but i am looking to do the same thing. i want to monitor bandwidth by ip/device on my network.

i currently use pfsense as the main router and i can see the WAN usage, but not sure if i can monitor by ip/device with pfsense.

are you saying i could setup untangle between pfsense (or any router/gateway) and my switch and see more granular bandwidth info?


exocet_cm
Free at last, free at last
Premium
join:2003-03-23
New Orleans, LA
kudos:3
Click for full size
Live traffic view
Click for full size
Live session view
Click for full size
Reports
Click for full size
Reports
Click for full size
»wiki.untangle.com/index.php/Intr···dge_Mode

This is one of my Untangle boxes in router mode (don't have any in bridge mode at the moment). You can view live traffic by adding a rule to the firewall module and monitoring a specific port by enabling "logging", there is a session mode to view current sessions, and you can look at archived reports or generate reports on the fly to view data.

You also have the option to export to excel .csv if you want to create a custom pivot table to dig through data (if you need control at that granular level).

It might be what you are looking for. Best part is that it is free.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com

tomdlgns
Premium
join:2003-03-21
Chicago, IL
kudos:1
looks good. i might look into this.

can you confirm that i can set this in between my pfsense box and network switch?


exocet_cm
Free at last, free at last
Premium
join:2003-03-23
New Orleans, LA
kudos:3
said by tomdlgns:

looks good. i might look into this.

can you confirm that i can set this in between my pfsense box and network switch?

I can't confirm but I don't see why not.
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com

tomdlgns
Premium
join:2003-03-21
Chicago, IL
kudos:1
when you set untangle to bridge mode, do you have to do any other configuration or is one nic in and the other nic out?


exocet_cm
Free at last, free at last
Premium
join:2003-03-23
New Orleans, LA
kudos:3
said by tomdlgns:

when you set untangle to bridge mode, do you have to do any other configuration or is one nic in and the other nic out?

That is pretty much the gist. Check out these resources:
Download: »www.untangle.com/store/get-untangle
Bridge mode FAQ: »wiki.untangle.com/index.php/Intr···dge_Mode
Installation forum: »forums.untangle.com/installation/
--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com

tomdlgns
Premium
join:2003-03-21
Chicago, IL
kudos:1
ok, i will check that out, thanks.

i installed untagle a few years ago so i am a little familiar with the setup, but never stuck with it or looked at the bridge mode option.


beachintech
There's sand in my tool bag
Premium
join:2008-01-06
kudos:5
reply to exocet_cm
Thank you for that, I actually had that same solution in my list and glad to see someone else bring it up.
--
Ex-Tech at the Beach.
I speak for myself, not my former employer.

HELLFIRE
Premium
join:2009-11-25
kudos:19
reply to Paulg
Was going to ask "are you sure about that," but then I dug up a few articles indicating the 3750s only track the 1st packet of the flow,
and the 29xx series switches will only do SNMP load-based polling.

@beachintech
Really dumb question, are they 3750s, 3750Gs, or the newer 3750Xs?

Do you have access to any other layer3 device within the network _IF_ Netflow or similar was needed?

Tell me I'm not crazy when I read this article that the 3750X has an addin module that does NetFlow -- »www.plixer.com/blog/netflow/cisc···support/

Regards


Paulg
Displaced Yooper
Premium
join:2004-03-15
Neenah, WI
kudos:1
Yes, the 3750X has an uplink module (PN: C3KX-SM-10G) that provides netflow, but only on the two uplink ports.


The WeaseL
Premium
join:2001-12-03
Minnesota
reply to beachintech
Do you want content filtering too or just monitoring? There are quite a few options targeted at the K12 space (cost some $), but they do more then just monitor traffic.
--
How lucky am I to have known someone who is so hard to say good-bye to.