looking for some advice to monitor network usage in office

[Jamie Beverly]

On Mar 25, 2009, at 1:12 AM, Ruben Laban <r.laban at ism.nl> wrote:

On Wednesday 25 March 2009 at 09:03 (CET), Rudi Ahlers wrote:
I've been asked by a college to setup a monitor to monitor a Windows
network, but on internet usage. They want to have detailed usage, i.e.
on a per IP / PC basis, and if possible to get stats for every
protocol, and see over a period of time what goes on.

My first though wat ntop, which does all of this, but it doesn't save
the data in a DB, so if the server reboots the stats are reset to 0. I
also can't get Cacti to give me stats per IP & per protocol (unless
someone knows how todo this).

I don't yet know the full network layout, but I have a feeling they're
using ADSL, and have a Windows Small Business server with ISA, and
possible Exchange as well. So, I'm either going to put a Linux box
between the Windows box & ADSL router, or maybe even setup a Linux
Vmware Virtual PC, force all the network to route via the VPS.


With pmacct, or any other utility that 'snoops' traffic, you will likely want to configure a "tap" on your switches that replicates all frames on a specific port. This will remove the need to do anything to your network topology, like changing routes. That one port will see the network as though it were on a hub (which, like all monitoring, has security implications) 

Depending on the size and complexity of your network, you may want to aggregate on tap ports, but forward and store to a monitoring host... 
 
Does anyone have some suggestions / experience in setting up something
like this?

P.S. Please don't look at the fact that there's Windows on the
network. I use Linux for business purposes, not as a hobby, and we
also use Mac & Windows where the situation calls for it.


Look into pmacct [1]. It can collect rather detailed information and can store 
it in various formats, including mysql/postgresql database.

[1] http://www.pmacct.net/

-- 
Regards,

Ruben Laban
Systems and Network Administrator
ISM eCompany

-- 
ubuntu-server mailing list
ubuntu-server at lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server
More info: https://wiki.ubuntu.com/ServerTeam