Internet Link Detective Audit

[Antony Mawer]

On 24/10/2006 10:08 AM, Edward Elhauge wrote:
> I'm hoping someone on this list can steer me in the right direction
> towards figuring out what is going on with my internet link. (Or rather
> the tools to figure it out on my own).
> 
...
> 
> What I'd like is a tool running on FreeBSD that will sort IP traffic
> coming across my Internet interface by:
>   SRC  IP, PROTOCOL and PORT
>   DEST IP, PROTOCOL and PORT
> then give me total KBs passed in that interval.

I was recently in a similar situation and went looking for a similar 
tool, and came across "darkstat" in the ports collection:

     http://www.freshports.org/net-mgmt/darkstat

While I did find it a bit rough around the edges in terms of some of its 
data display, it gave me a way to monitor and visualise my traffic flows 
and identify the large offenders...

In my case it turned out an OS X machine was set to automatically 
download system updates, but because no one had applied them yet, it was 
re-downloading them every day... :-)

Hope it helps!

-- Antony