Subject: Monitoring and reporting network usage

From: [email-masked]
Date: Sat, 12 May 2001 17:12:48 +0100 (BST)

Hi there,

	Apologies in advance if the cross-posting is not appropriate.
I am looking for some advice on monitoring and reporting network
usage.  I am currently running a FreeBSD box with an application
called 'Snuffle' to produce reports as to how much traffic is
going to each of the hosts on my network.

	Recently we have spotted that not all the traffic is getting
logged (with the biggest example being that we seemed to miss every
packet of a 1.5Gb upload last week) and so I have now decided to
look elsewhere for this kind of application.

	Will NeTraMet be able to log the network usage for each of
the IPs on my network?  If this is not be best choice in application,
has anyone got any other suggestions?

	I mentioned that I am using FreeBSD.  The reason for this is
that I was once told the *BSD operating systems have a better packet
capturing library.  When I ported the snuffle code to Linux it
seemed to miss a lot of the traffic.  Does anyone have any
advice as to an appropriate operating system for packet capture?

	Thanks in advance,

--
Sean Kelly

---

From: [email-masked]
Date: Thu, 24 May 2001 15:14:36 +0100 (BST)

Hi there,

        Thanks to all those who replied to my first message.  I have
a few points I wish to reply to and some new questions to ask.

        As a reminder, I will say that my problem is finding a new
network traffic monitoring application - preferably a free one!

        Some people asked me to explain my current setup a little
more.  I have a 4.2-RELEASE FreeBSD box with a 600Mhz Pentium III
processor and 64Mb RAM.  This is running 'Snuffle' by Thomas Ptacek
using a 100Mbit RTL8139-based network card.

        We have a 2Mbit Internet connection supplied with a Cisco
router (we have no access to the router itself).  We have plugged
this Cisco into a 10Mbit 4-port Netgear hub along with the FreeBSD
monitoring box and our main network switch.

        The hub's collision light flashes 2 or 3 times every couple
of seconds.

        The switch has various routers plugged into it, but basically
we have about 16 machines (50 IPs) in our network centre, about 40
IPs allocated to leased lines customers and about 70 IPs allocated
to ADSL customers.

        According to MRTG readings from our main router, our average
traffic over the past few months in about 48kB/s in both dorections.
However, if we look at the smaller time frames we see peaks sometimes
reaching nearly 200kB/s for output.

        The problem we are seeing with Snuffle is that it seems to
be missing some traffic.  On the above information, is the
assumption that the fault lies with Snuffle reasonable?  Could the
problem actually be that our machine simply cannot log all the
traffic that passes through it?  What are your opinions in running
NeTraMet in the above situation?

        Thanks in advance,

--
Sean Kelly