How can I get network monitoring with graphs per IP address?

belikeyeshua · Dec 25, 2009, 10:17 PM

According to this, http://doc.pfsense.org/index.php/How_can_I_monitor_bandwidth_usage%3F I've got a few options. My experience has been that the RRD graphs are way too basic and that NTOP does not work. I've read threads about it and it seems like lots of people have had this problem but with no way of fixing it.

Here is what I want to do:

1. Monitor network traffic per IP address in a 24 hour period. It would also be great if it could not monitor between the hours of 2:00 and 7:00 AM, as that is when we have "free downloads."

We have satellite, and we are only allowed 500MB/day. So, I want to monitor our users and see if we need to put some restraints on some of them (maybe load balancing or something?)

Does anyone know of a good free solution for us?

jimp · Dec 26, 2009, 1:29 AM

There are plenty of options outlined on that page, you only mentioned trying two of them. What of the others?

Darkstat and BandwidthD both graphed by IP also, I thought.

belikeyeshua · Dec 26, 2009, 2:16 AM

@jimp:

There are plenty of options outlined on that page, you only mentioned trying two of them. What of the others?

Darkstat and BandwidthD both graphed by IP also, I thought.

I just tried pfflowd, darkstat, vnstat, and bandwidthD. It seemed like vnstat was way too basic, and all the others did not work except for bandwidthD. So, I think I'll have to go with that… although the last time I installed that it did not show any graphs at all. Although maybe I can find the answer to that elsewhere.

Thanks for the reply.

0tt0 · Dec 28, 2009, 11:59 PM

@belikeyeshua:

According to this, http://doc.pfsense.org/index.php/How_can_I_monitor_bandwidth_usage%3F I've got a few options. My experience has been that the RRD graphs are way too basic and that NTOP does not work.

I run ntop with 3 NICs and it seem to work perfectly, collecting stats on all interfaces/subnets. I use 1.2.3-RELEASE and ntop 3.3.8.
I think I read someone else very recently also stating that it was broken but can't remember who it was, I'm a bit curious as to how it is broken, it is some minor issues or feature malfunctioning or what? AFAICT it's runnings fine and if it's not I haven't noticed how it is not yet..

Cheers,

jimp · Dec 29, 2009, 12:51 AM

ntop is an odd duck. I have some routers that it will run fine for months on end with no problems at all, and others were it won't run more than 5 minutes. I haven't yet been been able to narrow it down. I do have a newer build of the ntop binary to try if someone is curious, I can try to dig it up. I need to test it more and eventually get it into the real package.

0tt0 · Dec 29, 2009, 2:42 PM

@jimp:

ntop is an odd duck. I have some routers that it will run fine for months on end with no problems at all, and others were it won't run more than 5 minutes. I haven't yet been been able to narrow it down. I do have a newer build of the ntop binary to try if someone is curious, I can try to dig it up. I need to test it more and eventually get it into the real package.

I really do hope you can continue to provide this package and having it working well, it's really cool and can be very useful, if the box is powerful enough to handle it.

Cheers,

gommer · Dec 30, 2009, 9:07 PM

Is any of these mentioned packages suiteable or even available on embeded releases? I have the 1.2 embedded release running on WRAP platform and there's no trace of them. When searching both in the forum and on google, a thread from 2006 pops up that talks about shoehorning pfflowd into the embedded image. It also mentiones pfflowd including in the next embedded releases. I'm a bit confused here. I'm only just capable of understanding most of the pfsense functionality, let alone trying to build my own image.

Cheers, Marc

0tt0 · Jan 4, 2010, 6:54 PM

@jimp:

ntop is an odd duck. I have some routers that it will run fine for months on end with no problems at all, and others were it won't run more than 5 minutes. I haven't yet been been able to narrow it down. I do have a newer build of the ntop binary to try if someone is curious, I can try to dig it up. I need to test it more and eventually get it into the real package.

Maybe this is nothing but a coincidence but I'll make a note here.

I have for the first time seen a shutdown of ntop and there was some specific circumstances it seems.

I edited the settings for number of states to above default (10000) and after a while ntop stopped. After having changed back to default ntop has been running without stopping. That is the only time I've seen ntop stop working.

My guess though is that those events are unrelated in any technical way?

Cheers,

belikeyeshua · Jan 6, 2010, 3:09 PM

@0tt0:

@belikeyeshua:

According to this, http://doc.pfsense.org/index.php/How_can_I_monitor_bandwidth_usage%3F I've got a few options. My experience has been that the RRD graphs are way too basic and that NTOP does not work.

I run ntop with 3 NICs and it seem to work perfectly, collecting stats on all interfaces/subnets. I use 1.2.3-RELEASE and ntop 3.3.8.
I think I read someone else very recently also stating that it was broken but can't remember who it was, I'm a bit curious as to how it is broken, it is some minor issues or feature malfunctioning or what? AFAICT it's runnings fine and if it's not I haven't noticed how it is not yet..

Cheers,

Thats odd because I was beginning to think that whatever is making ntop not work is also whats making most of the other data collection tools I've tried not work. I was also thinking that its got to be 1.2.3-release that is causing the problem because I've tried it on 1.2-RC3 and it worked fine. So, maybe ntop will work in pfsense 2.0. I'll give it a try.