Linux

Check your bandwidth usage with bwm-ng


Sometimes it can be very useful to know exactly how much network bandwidth a particular host is using or how much traffic is being handled by a gateway. As a tool for taking a quick peek at network activity, I have yet to find a tool better than bwm-ng.

Bandwidth Monitor NG (or bwm-ng for short) is a simple network and disk bandwidth monitoring program which can be run from the console on Linux, BSD, and Solaris platforms. Various sensors are supported for the collection of statistics including /proc/net/dev, netstat, getifaddr, sysctl, kstat, /proc/diskstats /proc/partitions, IOKit, devstat and libstatgrab. Interfaces or devices can be black/white listed so that you only see the data of interest. Multiple output options are supported such as curses (text or graphical), plain text, CVS, and HTML.

Bwm-ng is very simple to compile and configure; I have compiled from source on both OpenBSD and Linux platforms without needing to download additional libraries or make changes to the code. Let’s take a quick look at compiling and running bwm-ng on an OpenBSD gateway:

First, download the latest version of its source from the Volker Gropp Web site. At the time of writing, the most recent release is bwm-ng-0.6.

Move in to your build directory and unpack the code:

# cd ~/build/

# tar –xzf ../ bwm-ng-0.6.tar.gz

# cd bwm-ng-0.6/

Before kicking off the configure script take a look at the options available:

#./configure –help

I found that all of the default settings were fine apart from the man page location. I manually set this:

# ./configure --mandir=/usr/local/man/

Build the binaries:

# make

Before installing we can test that bwm-ng will actually work. To do this, execute the compiled binary in the src directory:

# ./src/bwm-ng –o plain    (use ctrl+c to exit)

If that worked okay, then go ahead and complete the installation:

# make install

# cp ./bwm-ng.conf-example /etc/bwm-ng.conf

If you wish to configure bwm-ng further, then edit the configuration file using the man page as a reference for permitted option values. You may find that this is unnecessary as bwm-ng shows pretty much all you need to see by default.

Now that the program is installed it can be launched in the same way as any other binary executable would be:

# bwm-ng

Assuming that you’re using the standard ‘curses’ output option, then the command keys you’ll need to use will be ‘a’, ‘t’ and ‘u’.

‘a’    -    Toggle between all or selected interfaces (bwm-ng.conf)

‘t’    -    Switch the type of reading displayed between rate, max (peak), sum (throughput since program launch), and my favourite, which is the 30 second average

‘u’    -    Display bytes/bits/packets/errors

While bwm-ng is a very simple tool, it can be incredibly useful. I regularly use it to check up on the throughput of my main Internet gateway or spot-check the bandwidth being used by nagios to perform host/network checks. Obviously the uses of this program are limited, and for long-term monitoring and trend analysis, a more in-depth solution is required. I’m currently taking a look at Ntop and MRTG; it would be great to hear from people who have deployed and/or used one of these in a production environment. If you have -- then why not leave a comment and share your experiences.

13 comments
mgordon
mgordon

MRTG is excellent and a good compromise regarding granularity of measurement. By default it samples at 5 minute intervals. The interface for MRTG probes is rather generic -- it will call external programs or simple bash scripts and all it wants in return is four text lines: two numeric values and two text strings. What that means is that MRTG out of the box is very good for monitoring bandwidth on as many devices as you please, but anything that can be turned into a number can also be charted. I use it to display CPU utilization, free disk space, ping times. I think Cacti is just a front end to MRTG; it's slick in a way but didn't compel me to abandon the enormous flexibility I have working directly with MRTG. The difficulty with MRTG is setting up your displays, but once you have a template you can then easily replicate it. For instance, I have a template that displays a Cisco 3560 switch, all 48 ports, PLUS the same ports "clipped". In other words, normally a 10 megabyte-per-second burst scales the chart to 10 megs/sec, the rest of the day the line might be flat on the bottom at only 0.1 megabytes/sec. Clipping allows the second chart to ignore the burst and show the finer detail for the rest of the day. I don't think you can do that with Cacti. I also link directly from one switch chart to others following trunk ports. IN other words, if I see suspicious traffic leaving a switch on a trunk port, I have the HTML set up so that I can "walk" the chain, go to the next switch following HTML links. Eventually I go right to the port that has the suspicious traffic. Gotchas with MRTG: by default, it uses a numerical OID (object Identifier). If you add interfaces, the OID's change order and your charts no longer conform to your labeling. You can tell MRTG to use actual interface names to eliminate this problem. MRTG understands rate and gauges. A rate is computed inside MRTG by taking the new byte count and subtracting the previous byte count, displaying the result. Gauges don't do arithmetic, the value is simply displayed as delivered. As a final step, I run the whole flock of "day" image files (charts) through "image magick" to reduce them to 1/4 size and then display a large grid of charts so that I can see all WAN and LAN interfaces at once. Each little chart links to its big one. You can spent a lot of money and have all this done for you, of course.

ENowicki
ENowicki

I've used both MRTG and Cacti to monitor bandwidth on Cisco interfaces, and Cacti is by far the nicest interface to use once it's installed.

clevon
clevon

bwm-ng seems like a useful tool and can possibly give you spot checks on bandwisth usage. ntop however has been able to tell me bandwidth use based protocol, port and host. I use it on my proxy server and am able to tell which clients are using what ports and the bandwidth demands, give it a try, simple to install and easy to manipulate.

drichardson
drichardson

How do I compile this for Windows (XP)?

cesisson
cesisson

How do you direct it to look at "Internet Gateway" bandwidth usage? Is there a config file where I specify the IP of the interface to show data of? Right now, it looks like it is telling me the local interface usage. Thank you

justholmes
justholmes

Hi, Has anyone used bwm-ng with ipcop? I am using the net-traffic add-on, but it only gives total incoming and outgoing traffic, no specifics of protocols or programs. Justin H

chispol.rios
chispol.rios

Hi there, we have 4months aprox using Cacti, this is an excellent open_source app, we use cacti to monitoring interfaces with QoS enable, but, we have problems with spikes, 32bits/64bits counters. Could you show me your scripts or the way to use Mrtg directly with cacti. please. :) tnks a lot.

apotheon
apotheon

There are actually tons of pieces of open source software that can do interesting things with "anything that can be turned into a number". It's one of the things I love about open source software -- you can do anything with almost nothing, generally speaking. For instance, you could create a network monitoring system with a couple of Perl scripts and a desktop display utility called Conky if you really want to. Just feed numbers into Conky's display options, and it'll paste the particular representation you choose for a given piece of data directly to your window manager's root window. I don't know how I ever survived in a world of proprietary software networking.

bpate
bpate

Cacti has been a fantastic tool. Once you learn how to set it up. Which takes reading an encyclopedia to do. It does run fantastic and it is easy to backup using libarchive and automysqlbackup.

richard.wilson
richard.wilson

On my network I use Scrutinizer NetFlow Analyzer for my bandwidth monitoring. It can pull information from several different router interfaces at once. I can monitor internet and intranet usage at the same time with two different reports. It also has the ability to drill down to IP usage, so I can clearly see who is downloading or uploading to where. It is very useful in a situation like mine, as we have multiple LANs connected across the country. Hope this helps....

clevon
clevon

If you have a fedora system you can use the basic ethereal tools, this can be installed as an option with gnome. Another option is as stated a tool like Ntop. Installed on teh gateway, it can tell you the usage of bandwidth by every interface and every client connecting to the internet. Ntop gives pretty detailed statistics, you can get it at their site www.ntop.org. You will however need to follow the links to get the rpm or source code.

patg
patg

I need application to run on a Windows machine to tell me how much bandwidth each IP address uses each month. I do not have a Cicso router. Would this work under these conditions?