Internet Link Detective Audit

[Ed Stover]

Bob Martin wrote:
> There is also the old and venerable ntop, in the ports.
> 
> Bob Martin
> 
> Antony Mawer wrote:
>> On 24/10/2006 10:08 AM, Edward Elhauge wrote:
>>
>>> I'm hoping someone on this list can steer me in the right direction
>>> towards figuring out what is going on with my internet link. (Or rather
>>> the tools to figure it out on my own).
>>>
>> ...
>>
>>>
>>> What I'd like is a tool running on FreeBSD that will sort IP traffic
>>> coming across my Internet interface by:
>>>   SRC  IP, PROTOCOL and PORT
>>>   DEST IP, PROTOCOL and PORT
>>> then give me total KBs passed in that interval.
>>
>>
>> I was recently in a similar situation and went looking for a similar 
>> tool, and came across "darkstat" in the ports collection:
>>
>>     http://www.freshports.org/net-mgmt/darkstat
>>
>> While I did find it a bit rough around the edges in terms of some of 
>> its data display, it gave me a way to monitor and visualise my traffic 
>> flows and identify the large offenders...
>>
>> In my case it turned out an OS X machine was set to automatically 
>> download system updates, but because no one had applied them yet, it 
>> was re-downloading them every day... :-)
>>
>> Hope it helps!
>>
>> -- Antony
>>



I know this is a old post but no one covered iftop and trafshow . The 
combination of those two has helped me track bad bandwidth "leaks" for a 
while now.