Per-User Traffic Bandwidth Monitor

focalguy

The Rate package is supposed to be nice but I could never get it to show accurate results.

Darkstat works for me. If you see that there are connections to pandora or whatever you can click on the IP address and it will tell you traffic narrowed down by port. You can then go to your state table and filter by the ip and port such as x.x.x.x:8654 and then you will see which user has an open state to that external IP on the port that is using all the traffic.

Not the quickest or most convenient but it has worked well enough for me.

bear24rw

Check out the 'rate' package it does exactly what youre looking for

kapara

install pfflowd package. Download and install manageengine netflow monitor. This can monitor 1 or 2 interfaces for free. Call presales support for assistance with initial config. This will give you a breakdown of per ip and per protocol traffic. I doubt any of the other packages can beat this. Manageengine needs to be installed on any old pc. Tech is based on neflow….... If you want to monitor more interfaces then buy a license......

excellent tool for analisys and free and also gives historical

good luck

jjj

RATE puts me int the same boat as before…it only monitors a single interface at a time and doesn't draw the line between source and destination traffic. It also shows me that the firewall's interfaces themselves are what are consuming all the bandwidth.

pfflowd sounds nice, but the two free interfaces aren't enough and we're already using it to monitor our routers.

jimp

You can also try the 'iftop' package from a shell prompt:

# pkg_add -r iftop
# rehash
# iftop -i <lan nic=""></lan>

It might get you a little closer to what you want.

jjj

Yes, it does look look nice.

What would be the uninstall command (Besides using it as an appliance, I am pretty much handicap when it comes to Linux)?

jimp

If you want to get rid of it, do:

pkg_delete iftop-\*

If you want to be more precise, you can look at the output of:

pkg_info

and find the line for iftop, something like this:

iftop-0.17          Display bandwidth usage on an interface by host

Then you can do:

pkg_delete iftop-0.17

jjj

Great, thanks for the thorough instructions!

jjj

I get the following:

pkg_add -r iftop

Error: FTP Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.0-release/Latest/iftop.tbz: File unavailable (e.g., file not found, no access)
pkg_add: unable to fetch 'ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.0-release/Latest/iftop.tbz' by URL

I checked the FTP and the packages-7.0-release doesn't exist, the only "release" folder is packages-8.0-release.

There's actually no 7.0 anything folder, only packages-7-stable.

???

jimp

What version of pfSense are you running? pfSense 1.2.3 should be 7.2-RELEASE

Either way, you can do this instead:

pkg_add -r ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7-stable/Latest/iftop.tbz

jjj

1.2.2….. We need to upgrade.