Realtime Bandwidth Monitoring

Ok, basically what i'm querying the forum for some sort of semi-simplistic "utility" that works sort of on the terms of an agent/server relationship that monitors a group of machines in realtime to determine how much bandwidth each individual machine is currently using.

In other words, from the central server, I'd like to be able to see who the fsck has a damn HIDDEN KAZAA running on one of the 40 machines here and sucking up the entire fscking net-cafe's bandwidth so that no other user can even check their damn e-mail without wondering if the cafe network is being shared on a 28.8 modem... Anyway I'd like to mitigate this horrific issue that is happening more and more often lately as soon as possible.

I realize I can see "what programs" are running with other methods such as thru SMB queries but this is inefficient in that, if the "user/jerk" is "advanced" enough they can hide bandwidth hogging malicious utilities so that they don't show up under normal circumstances. Therefore, being able to see how much BANDWIDTH a particular system is using in realtime could allow me to simply SHUT the damn thing off if I cannot immediately remedy the problem.

the users must not be able to see the "agent" that monitors the bandwidth (so they cannot terminate it). Any useful suggestions?

-me

 

First off, to block the KaZaa problem, just block the KaZaa subnet.... Then unplug your network for a second (KaZaa loses it's connection) then restart the network (plug the hub back in) and there ya go, no more KaZaa problem, blocking ports is useless since it can use 80 and other stuff

Second off, why don't you just limit the bandwidth each machine can use? They can't go over 100 kb or a limit like that....

Third off, if you have a router/firewall between the 40 boxes and a the hubs/cable modem/what have you why don't you just run the software on that machine (if you find some)

 

Vlad, I appreciate your advanced and "cool sounding" suggestions but what you don't understand is that I do not have access to the hubs, router, switches or ANY of the other hardware here because... well because the owners are afraid of their own ****ing shadow (fscking morons if you ask me). They have another jackass unintelligent HALFWIT who does all "that type of work" and so I don't have a key to the rack that holds the equipment.

All I can do is sit there and stare at the shit knowing that if something TRULY horrible happens, we'll just have to call that other MORON admin from his vacation that he's currently taking (hopefully somewhere in hell).

Secondly, we cannot block kazaa because UNFORTUNATELY, that is what a good percentage of the "other" jackasses (customers) come in here and ask for so they can get their stupid pr0n. We need an easier solution that is software based and centrally controllable so that we can ALLOW yet LIMIT HOW these sheep use kazaa and other bandwidth-black-holing crap.

Our LEGITAMATE users deserve better. Idealy, I'd like to be able to see (as i said previously) from one system, what type of bandwidth use is going on on all the other systems and then simply walk on over to the offending machine and STOP whatever nonsensical shit is happening on it.

I appreciate the reply and I'd like to say that the suggestions you made are among the FIRST 4 possible solutions I had in my head as well until I realized we can't viciously murder kazaa in cold blood (as I would like).

:edit:

How would I go about accomplishing this? Setting up QoS on the network is just not possible in my current retarded situation where I can't touch the stuff I MOST NEED access to. Even if it were, I don't get paid enough for that and plus, it would be too time consuming and difficult to keep maintenance on. That is why i'm looking for some kind of third pary solution that can remedy this hemroid of a fscking problem.

-peace

 

http://www.majorgeeks.com/download.php?det=1089

 

This looks very promising, yet not overkill.. Excellent, my thanks to you for the suggestion and I'll report if it does it's job like it claims it does....

regardless if it does or not, thanks.

 

I use it to monitor which pc's take up the most bw in my facility. So just name your machines with names that you'll recognize (perhaps location wise. i.e. pc near the window) etc. and it'll make it easier to pin point.

The default setup is 1 hour update I believe , but you can change that.

 

To bypass the guy who "runs" the network either find some wires that lead to the hubs beige box (splice into them and hook yourself up) them, and set up your own mini-router going between them, this of course is not too highly recommended The only way that I know of doing this is using PF (Packet Filter) under OpenBSD, I'm _sure_ there are other ways but this is the only one I have needed, you probably don't want to set up a new OS just for it though...

You might actually want to ARP poison your own network (heh) and find the box. Are you consulting for this network or working there? If consulting either jack up your rates, or threaten to quit if they don't comply, and if they don't just quit, of course if you work there that obviously calls up some problems...

 

ARP poisoning is no longer possible (or at least mitigated by 95%) on this network. Anyway I've had enough ARP poisoning this year to last a lifetime!

::sigh::

 

Never enough ARP poising Are you using switches or hubs? If hubs your in business... if not... then you can probably still do it...