In my network of about 10 computers, I would like to know who is using how much internet data. My data cap is finishing faster than it should and I need to find the host + application responsible.
Current set-up: all LAN hosts and the router connect to a managed switch. The port to router is being mirrored to a port connected to a monitoring PC. Thus, all traffic to/from the router (incl. internet traffic) is being copied to this port.
Attempt so far
On the monitor PC, Wireshark is able to pick up the packets that I am interested in e.g. HTTP GET requests made by other hosts on the LAN. However, the Wireshark output is too raw for my purpose. I would appreciate any pointers to a tool that can instead display total volume of traffic grouped by each host/IP.
- ntopng - This is exactly what I want! However, it doesn't always work. On one Windows PC, its service only runs for a few seconds and auto-stops for some reason. On another Windows machine it captures no traffic (drops all packets). On a linux machine it seems to only capture local host's traffic. On all these 3 machines Wireshark still works exactly as it should, thus I'm sure all packets I need analysed are reaching the NIC.
- Wireshark - Too low-level and verbose
- Etherape - Limited information available
- PRTG - Updates only every 30-sec, complicated UI and over-featured
- Networx - only monitored local PC's traffic
- DU Meter - only monitored local PC's traffic
- Microsoft Message Analyzer - didn't pick up any traffic
- Fiddler - only picked up local PC's HTTP traffic
- Must run on Windows or Linux. Former preferred.
- Not software that needs to be installed on every host and then report to a central logger
- Not using a custom firmware (e.g. DD-WRT or Tomato) on the router
- Present the analysis of packets captured in a simple way which allows me to view a list of top internet usage hosts (by volume), their actual usage (volume), over which application layer protocol and maybe even which service on the internet was being communicated with (e.g. YouTube, Facebook, etc.)
Am willing to pay for a decent tool, but it should deliver on requirement 4. above. If you think I have not used any of the tools mentioned above properly and all my requirements can be met by any of them, please do let me know.