Sniffing and Analysing Internet Usage via Port Mirroring

Question

Goal

In my network of about 10 computers, I would like to know who is using how much internet data. My data cap is finishing faster than it should and I need to find the host + application responsible.

Current set-up: all LAN hosts and the router connect to a managed switch. The port to router is being mirrored to a port connected to a monitoring PC. Thus, all traffic to/from the router (incl. internet traffic) is being copied to this port.

Attempt so far

On the monitor PC, Wireshark is able to pick up the packets that I am interested in e.g. HTTP GET requests made by other hosts on the LAN. However, the Wireshark output is too raw for my purpose. I would appreciate any pointers to a tool that can instead display total volume of traffic grouped by each host/IP.

Softwares Tried

1. ntopng - This is exactly what I want! However, it doesn't always work. On one Windows PC, its service only runs for a few seconds and auto-stops for some reason. On another Windows machine it captures no traffic (drops all packets). On a linux machine it seems to only capture local host's traffic. On all these 3 machines Wireshark still works exactly as it should, thus I'm sure all packets I need analysed are reaching the NIC.
2. Wireshark - Too low-level and verbose
3. Etherape - Limited information available
4. PRTG - Updates only every 30-sec, complicated UI and over-featured
5. Networx - only monitored local PC's traffic
6. DU Meter - only monitored local PC's traffic
7. Microsoft Message Analyzer - didn't pick up any traffic
8. Fiddler - only picked up local PC's HTTP traffic

Requirements

1. Must run on Windows or Linux. Former preferred.
2. Not software that needs to be installed on every host and then report to a central logger
3. Not using a custom firmware (e.g. DD-WRT or Tomato) on the router
4. Present the analysis of packets captured in a simple way which allows me to view a list of top internet usage hosts (by volume), their actual usage (volume), over which application layer protocol and maybe even which service on the internet was being communicated with (e.g. YouTube, Facebook, etc.)

Am willing to pay for a decent tool, but it should deliver on requirement 4. above. If you think I have not used any of the tools mentioned above properly and all my requirements can be met by any of them, please do let me know.

Answer 1

Capsa seems to correspond with your requirements:

• Must run on Windows or Linux. Former preferred: Runs on Windows, at least from XP to Windows-8 are supported officially.
• Not software that needs to be installed on every host and then report to a central logger: As I read it, it needs to be installed on a single machine only. From there it "sniffs" on the network using the so-called promiscuous mode of the network card, thus being able to capture all packages of the (local) network – including those not intended for the machine it runs on.
• Not using a custom firmware (e.g. DD-WRT or Tomato) on the router: Nope. It works with a broad range of different network adapters directly from the Windows machine, no modifications to your router(s) required.
• Present the analysis of packets captured in a simple way […]: Capsa features a Dashboard with easy to understand graphs, all "major information" in one place – from where you can chose to dig deeper. It even promises e.g. an "Intuitive TCP timing sequence chart", and more.

You can also find a product summary at Wikipedia. Capsa comes in two flavors: Free for teachers, students, geeks, nerds in a non-commercial context – and a paid one for commercial use starting at ~USD 700 (Professional Edition) to ~USD 1,000 (Enterprise). A comparison can be found e.g. in mentioned Wikipedia article – or, more complete, at ColaSoft's website.