Member Avatar for ITech

i want to monitor the egress interaface(tx) of the firewall and identify the users bandwidth, visited websites, who is having the most bandwidth for internet etc. i am planning to do this by port mirroring the port which is going to the firewall.

the mirrored port will be connected to the monitoring system, so that what ever tx traffic goes to the firewall goes to the monitored system.

Can anyone tell the best open source software that can do this. with graphs, user identification via IP address, the sites visted etc

  • 3 Contributors
  • 2 Replies
  • 322 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by BigPaw

Dani AI

Generated

Good summary and useful starter suggestions from , and . Two complementary approaches work best for the stated goals (per-IP bandwidth, visited sites, top users): use flow exports for continuous accounting and graphs, and keep packet-level captures for occasional forensic drills. Flow protocols (NetFlow / IPFIX / sFlow) give compact per-flow counters that are ideal for long-term top-talkers and graphing. (rfc-editor.org)

Suggested open-source stack (mix and match):

  • Flow collection + UI: ntopng (real-time/top-talkers, flows + pcap drill-down). (ntop.org)
  • Deep protocol and HTTP/TLS logging for visited-host and URI extraction: Zeek (Bro) or Suricata — Zeek excels at high-fidelity logs (DNS, HTTP, TLS metadata) that feed reports. (zeek.org)
  • Large-scale flow archiving/querying: SiLK / nfdump for fast historical queries if retention and scale matter. (tools.netsa.cert.org)

Mapping IPs to users and producing graphs:

  • If per-username reporting is required, capture authenticated proxy/firewall logs (Squid can log usernames when authentication is used) or correlate DHCP/RADIUS + directory events with flow records. Feed logs/flows into Grafana/Elastic for dashboards or use ntopng’s built-in charts. (wiki.squid-cache.org)

Quick example captures (for a mirrored egress port):

# packet forensic capture (mirror port)
tcpdump -i ethX -w /tmp/egress.pcap

# simple NetFlow listener (nfcapd)
nfcapd -p 2055 -w /var/flows

Cautions and troubleshooting: SPAN/mirror ports can drop or alter packets under load and may not mirror everything (check switch/SPAN limits); a hardware TAP or accelerated capture stack (PF_RING / zero-copy) is recommended for high rates. Also note that HTTPS + encrypted SNI / ECH and encrypted DNS reduce ability to see visited hostnames or full URIs, so flows + metadata are the practical ceiling for many modern sites. (cisco.com)

Short checklist: prefer NetFlow/IPFIX from the firewall when available; run Zeek/Suricata for app-layer logs; add authenticated proxy or DHCP/RADIUS correlation for usernames; validate mirror for packet loss or use a TAP/PF_RING capture host for line-rate visibility.

Recommended Answers

All 2 Replies

Member Avatar for CimmerianX

If you have any cisco devices that support it, the devices can export NetFLow Data to a host PC. Very similiar to how it can send logging data to a syslog host. In this case, the netflow data can be analyzed in the fly by certain software to report on the data you want ( i.e. who is using the most traffic to visit a dancing cat video...).

There are some opensource network monitors out there.... look at http://www.ghacks.net/2011/09/08/networktrafficview-network-monitoring-statistics-tool/ this one is fairly decent.

Member Avatar for BigPaw

Not knowing anything about the platforms involved, or the environment.

Cacti may do what you need.

isn't too expensive, in fact considering it's for a Mac it's practically a freebie. :-)

There is also some very good advice here regarding the matter of monitoring the use of the Internet by employees.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.