How to find who is generalizing traffic
-
The network generates traffic in Internet upload for about 500MB per hour, this only in certain hours of the day.
My ISP is penalizing me for this excessive traffic and therefore I have to find who is generalizing it.
How can I do from pfsense? -
Hi,
The first thing that comes to my mind is ntopng where you can record and then analyze all kinds of per-host metrics, including traffic.
-
@whitetiger-it there are several packages in the package manager that can reveal that for you. Darkstat, BandwidthD, Traffic_Totals and the much more complicated NtopNG.
-
I know only traffic totals (and only a little); I don't remember if stats is for single PC.
I do not know the other tools and therefore I ask you for advice.
However, I need to find the PC that is generalizing traffic in INTERNET UPLOAD.
The traffic over PC’s ethernet card is also for other reason, for example to NAS, server or printers. -
@whitetiger-it said in How to find who is generalizing traffic:
I know only traffic totals (and only a little); I don't remember if stats is for single PC.
I do not know the other tools and therefore I ask you for advice.
However, I need to find the PC that is generalizing traffic in INTERNET UPLOAD.
The traffic over PC’s ethernet card is also for other reason, for example to NAS, server or printers.Yeah, think your are right about Traffic_Totals - that’s only for combined traffic. BandwidthD or Darkstat is what you are looking for. They will summarize traffic for individual IPs.
But if you route traffic to your servers, printers and what not (through pfsense to another interface), that will be included by default to. But there is likely a “internal network” type definition you can setup to have them exlude traffic to other local IP scopes.
