5

Goal

In my network of about 10 computers, I would like to know who is using how much internet data. My data cap is finishing faster than it should and I need to find the host + application responsible.

Current set-up: all LAN hosts and the router connect to a managed switch. The port to router is being mirrored to a port connected to a monitoring PC. Thus, all traffic to/from the router (incl. internet traffic) is being copied to this port.

Attempt so far

On the monitor PC, Wireshark is able to pick up the packets that I am interested in e.g. HTTP GET requests made by other hosts on the LAN. However, the Wireshark output is too raw for my purpose. I would appreciate any pointers to a tool that can instead display total volume of traffic grouped by each host/IP.

Softwares Tried

  1. ntopng - This is exactly what I want! However, it doesn't always work. On one Windows PC, its service only runs for a few seconds and auto-stops for some reason. On another Windows machine it captures no traffic (drops all packets). On a linux machine it seems to only capture local host's traffic. On all these 3 machines Wireshark still works exactly as it should, thus I'm sure all packets I need analysed are reaching the NIC.
  2. Wireshark - Too low-level and verbose
  3. Etherape - Limited information available
  4. PRTG - Updates only every 30-sec, complicated UI and over-featured
  5. Networx - only monitored local PC's traffic
  6. DU Meter - only monitored local PC's traffic
  7. Microsoft Message Analyzer - didn't pick up any traffic
  8. Fiddler - only picked up local PC's HTTP traffic

Requirements

  1. Must run on Windows or Linux. Former preferred.
  2. Not software that needs to be installed on every host and then report to a central logger
  3. Not using a custom firmware (e.g. DD-WRT or Tomato) on the router
  4. Present the analysis of packets captured in a simple way which allows me to view a list of top internet usage hosts (by volume), their actual usage (volume), over which application layer protocol and maybe even which service on the internet was being communicated with (e.g. YouTube, Facebook, etc.)

Am willing to pay for a decent tool, but it should deliver on requirement 4. above. If you think I have not used any of the tools mentioned above properly and all my requirements can be met by any of them, please do let me know.

  • Reading between the lines: your router doesn't give you that information? As that would be the best place to get it – and also where a quota could be established (if that's wanted; and yes, understood you don't want a custom firmware on it). – Izzy Sep 25 '15 at 8:00
  • 2
    Btw: While waiting for good answers: The Top 20 Free Network Monitoring and Analysis Tools for sys admins mentions e.g. Capsa Free and Pandora FMS which look like good candidates. – Izzy Sep 25 '15 at 8:09
  • @Izzy: Our router doesn't provide that info off the web UI. I could try SNMP but from reading around I feel I won't get all the info I need. Good news: I tried Capsa Free and it works nicely! I had checked out that link earlier but amidst other personally irrelevant softwares in the list I didn't bother investigating each of them individually. Thank you for pointing it out. Pandora FMS was too big to download so I haven't tried it yet. If Capsa continues being helpful this week, I might just stick to it and pay the license fee ($1k!). Feel free to post your answer below so I can mark it so. – Islay Sep 27 '15 at 21:33
  • Did so. If Capsa Professional suffices, you can save a few hundred bucks. Good luck! – Izzy Sep 27 '15 at 21:57
2

Capsa seems to correspond with your requirements:

  • Must run on Windows or Linux. Former preferred: Runs on Windows, at least from XP to Windows-8 are supported officially.
  • Not software that needs to be installed on every host and then report to a central logger: As I read it, it needs to be installed on a single machine only. From there it "sniffs" on the network using the so-called promiscuous mode of the network card, thus being able to capture all packages of the (local) network – including those not intended for the machine it runs on.
  • Not using a custom firmware (e.g. DD-WRT or Tomato) on the router: Nope. It works with a broad range of different network adapters directly from the Windows machine, no modifications to your router(s) required.
  • Present the analysis of packets captured in a simple way […]: Capsa features a Dashboard with easy to understand graphs, all "major information" in one place – from where you can chose to dig deeper. It even promises e.g. an "Intuitive TCP timing sequence chart", and more.

You can also find a product summary at Wikipedia. Capsa comes in two flavors: Free for teachers, students, geeks, nerds in a non-commercial context – and a paid one for commercial use starting at ~USD 700 (Professional Edition) to ~USD 1,000 (Enterprise). A comparison can be found e.g. in mentioned Wikipedia article – or, more complete, at ColaSoft's website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.