Bandwidth Monitoring Program Suggestion?

[bigpimpboy14]

Hey all,

Question:

I need to implement a way to track who uses what bandwidth at the company where I work. The internet has been very slow recently, so this is my newest project, per the administration. Currently, all the computers are connected to a switch, that switch is in turn connected to a hub, and that hub to a router that eventually leads to the T1. A computer is in the closet (giggle) connected to a hub as well, currently using MSN Monitor, and it logs all the MSN Messenger IMs. (because the hub duplicates everything on every port)

Does anybody have a suggestion as to what program I should use that'll keep track of who downloads the most? And it'll let me look at a daily, weekly, etc. logs? Also, will it work how I have the network set up now? Or will I have to add another NIC to that computer, and loop the internet through it? (if so, can someone walk me through the config?)

Thanks a million =D

 

[Kins123]

Hello,

Do you use a Windows Server? Something like Small Business Server 2003? The premium edition comes with ISA Server, which is an advanced firewall system. I'm not sure whether ISA comes with bandwidth monitoring tools out of the box, but there are extensions which can be added which have these features. One of them is called Bandwidth Splitter.

Installation of ISA server is not for the faint hearted though. It can easily fuck up your network.

You could also take a look at Smoothwall Express which is an open source linux based firewall. The idea of it is to take an old computer and turn it into a dedicated firewall. I'm not sure how good its bandwidth monitoring system is but they have a pretty active forum you could check.

About the MSN monitoring, are you allowed to do that? I'm not sure about the laws on privacy etc but it might be worth checking it out. Maybe someone here will know.

ISA Server - http://www.microsoft.com/isaserver/default.mspx

Bandwidth Splitter - http://www.bsplitter.com/

Smoothwall Express - http://www.smoothwall.org/

 

[bigpimpboy14]

Kins,

We have a windows 2000 server that takes care of logins, permissions, hosting all the printers, and all the files.

About the firewall issue, we already have a firewall in place, a Cisco ASA5505, which also has us on a VPN with our main office in Texas (we're in Miami).

I have 2 spare computers that can be put to whatever purpose need-be, they're both running windows XP. Our network is relatively small, 26 computers, plus the server, plus printers, so setting up a new expensive server is out of the question. I'm probably not going to be able to spend more than $200.

Notes:

Technically I'm overseen by our IT department in Texas, but they're extremely unhelpful and our offices are basically the bastard step child. I can't get in to configure the ASA (THEY can't even configure it; they hire someone as-needed to configure it), so adding a firewall I believe will cause problems with the existing firewall. =\

As for the IMs... The because we sell exclusively for international wholesale export, all our customers are overseas. As such, about 90% of our sales are done through the IMs. The president wants to make sure everything is OK, and nothing is going on on the side. I would think it'd be perfectly lega. If you're on company time, the company has the right to monitor what you're doing. Theoretically, they're working, so they have nothing to hide, right?

::sigh::

 

[bigpimpboy14]

Update:

Here's basically the issue: at times, the internet runs extremely slow, obviously due to someone downloading something. The program we use for our operations is based in Texas (again, we're in miami) and employees have to log into the terminal server in texas over the internet, so the administration gets pissed when the internet is slow. My job is to find a way to catch the huge downloader in the act. Maybe a program that compiles current average download speeds per user/IP address? Our switch's lights blink really slow so looking at switch won't help.

 

[Kins123]

I don't quite understand how you're putting the IM/MSN traffic through a PC unless you've got it set up purely as a pass-through device

I expect it works because of the hub. From how I understand it hubs just broadcast everything they receive to every port to find the right destination. Which is why it's inefficient and less secure than a switch. The computer must be setup to just listen for the MSN traffic.

 

[Corny]

i use ethereal for stuff like that:

http://www.ethereal.com/

depending on your company size this might become much data, but you can use filters and bells and whistles to set it up to your own needs.

 

[bigpimpboy14]

Woo hoo! I knew I posted my question in the right place. I'll be back in the office on Tuesday, so I'll try it out and keep ya'll updated on the results.

 

[bigpimpboy14]

I did some research, and ended up going with a program called WFilter. It does everything we need, and them some.

http://www.imfirewall.us/WFilter.htm

It tells you real-time bandwidth usage, and then keeps a record, and lets you run all kinds of reports with all sorts of different options. I highly recommend it to anyone looking for this sort of solution.

 

[mike_n_herrin]

/\ glad you found something that you think will work for you. let us know how it works out...and what the offending person is downloading. lol of course they might just be listening to streaming radio or something and not like downloading big files.

 

[bigpimpboy14]

Well before I implemented it, the President was very angry one day and had me physically go to each person and inspect what they had open. I found internet radio open on one computer which i asked her to close.

As a sidenote, however, I deployed this on Friday the 25th. Tuesday the 29th they fired an employee who they discovered was disclosing trade secrets with a friend of his working at a competitor. With WFilter, we also learned he spent his entire day on facebook (loaded 'facebook.com' 86 times), and was browsing 3 different sites for cars, one of them being craigslist.

What I like though about WFilter is also the ability to block websites, which we intend to implement in the future, if youtube video-watching gets out of hand.



Gosh, the only thing this program doesn't do is make toast.

 

[bigpimpboy14]

a company like this should simply only give internet access to the ones who need it and then go another step and limit them to which sites they can get too. that is just my feeling if the services u need to run demand low latencys. remember it might not be one user doing it, it can be many users at once slowing the connection.

Well I've been strongly pushing restricting the internet, but they don't want to do anything yet. At this point, Limewire and many P2P ports have been blocked on our firewall by the big dogs in Texas, so at least that's taken care of. Right now our major problem is stupid people on youtube, internet radio, and people watching streaming porn.

Another sidenote: President can't stop laughing at the fact that he discovered the guy in the office next to him watches cheerleader and swinger's porn.