Networks

Ask something
Discussion Locked

Network Usage

0 helpful
6 replies

by i_m_dougie 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a bonded T-1 with a 3mb/s capacity. I called out ISP and found that 2.2mb/s (1.1 on each T-1) is in use.

Unless someone here is downloading and/or streaming music 24 hours a day, something's not right here.

Does anyone know an easy (and inexpensive) method of figuring out our where our bandwidth usage is coming from?

6 replies

by exnn

Have you taken a look into your router's logs?
Also you can see current transactions/forwards the router is performing in that precise moment, without logs. You can trace the inside computer/user, maybe some virus running on your LAN.

by robo_dev

Protocol Analyzer. Ethereal is free. There are dozens of commercial products as well.

I would look at the utilization statistics for the ethernet ports on the wan side of your network. If you have a proxy server, it should have lots of logs.....

by mshavrov

Yes, you should use a protocol analyzer (sniffer) on the line between your network and your router. And about this traffic... There is nothing strange - somebody may have peer-to-peer software (Kazaa, BitTorrent, eDonkey, etc.). These applications will create steady stream of traffic.

Do you have a firewall between your PCs and your Internet? It could be another point, where you may take a look at the traffic. Firewalls usually create a log when traffic starts, and when it stops. So, you may analyze what happend during the night, when nobody was in the office, and detect who creates this traffic.

Also, if you have access to the router, you can monitor the interface utilization yourself. I would recommend to install MRTG to monitor your links utilization. You can get it as pre-built appliances for VMWare Player. If you don't have access to the router, you may monitor your LAN interface on the firewall.

Good luck,

Mike
CCNP, CCDP, CCVP, CCSP, Security+, MCSE W2K, etc.
http://www.ciscoheadsetadapter.com

by i_m_dougie

Thank you for the advice. I do have access to the router and have been looking at the logs. I see some high traffic spots.

Also I see some errors that are coming from old settings on the (old as dirt) router we use.

Hopefully things will clear up a bit once I clean out the settings.

by lamczyknic3000

Configure snmp and use a packet sniffer (try ethereal.com it is a free packet sniffer and works extremely well) to check and see how much traffic is going across the network. You could have routers constantly relaying info taking up bandwidth along with servers contacting one another taking up bandwidth. If you have servers trying to contact a device that is no longer their but is still seen by the server then bandwidth could be eaten up. 100's of UDP packets a second could be sent out because the servers are trying to find something that is no longer there.

This discussion is closed to new replies.