How to tell what mac address or ip address is using the most bandwidth?

[rizwan602]

Hello,

I have been asked to fix internet access problems at a high rise condominium where all the residents get internet through the home owners association. They are currently providing high speed internet by DSL. They HAD a simple Linksys router; which I replaced with pfSense (I am a m0n0wall die-hard).

In m0n0wall one could look up firewall states and SORT a column which shows packet count in a row with the ip address or mac address (I can't remember). Anyway I can not find the same sorting ability in pfSense.

Is there a way to do this or a BETTER way to find out which mac address or ip address is using the most bandwidth?

Also is there a way to look at OUTBOUND traffic too and be able to see who's using the most?

Any help is a greatly appreciated! I wish to not deploy m0n0wall but will if necessary. I think pfSense should have what I need.

Thanks!!

[jimp]

The states are under Diagnostics > States and you should be able to click the column headers to sort them.

That won't tell you bandwidth, though. You will need to install a bandwidth monitoring package such as darkstat, which can graph by IP.

If you want to watch "live" you can install iftop using pkg_add and use it from the shell.

[dreamslacker]

In pfSense 2.0, you can monitor in realtime using the Status -> Traffic Graph and switch to LAN.

For pfSense 1.2.3 or periodic checks (on either platform), you will need a package like DarkStat/ BandwidthD.

[jimp]

Using that page works somewhat but the data does not stay visible for long. Someone would have to be sending tons of traffic to show there continually. Using one of the longer term graphing packages would be more effective, or using something like iftop which collects stats over a bit more time rather than starting fresh every couple seconds.