Best of the ISP-Lists

How Much Bandwidth?

Members of the ISP-Webhosting list discuss different hardware and software solutions for measuring how much bandwidth a Web server uses.

[December 11, 2002]

On the ISP-Webhosting discussion list in November, MM asked:

"Does anyone have any experience using a hardware or software solution to measure how much bandwidth a machine on your network is using?

I would like to measure the bandwidth of three wintel boxes that are web and mail servers for my clients running off of my T-1. Anyone have any ideas?"

[ED recommended] "MRTG [Multi Router Traffic Grapher] and managed switch."

[TD recommended] "Number of ways to measure bandwidth:

1. If you have access to the SNMP read-only community name for the managed switch, configure MRTG with 95th percentile or whatever to monitor the ports for Incoming and Outgoing traffic. Must know the relevant MIBs to monitor for your particular ports.
2. You can do the same on the Network Interface's available on the Wintel Boxes ( Linux or Win2K) by enabling the native SNMP agents.
3. Alternatively, go to a commercial network monitor like RapidProbe, which can autodetect the SNMP variables you want to monitor for either OS (Linux or Win2K) for you for a small fee."

[ED replied] "Never trust a customer box."

[JK recommended] "Emerging Technologies, bandwidth management solutions."

[NL chimed in] "You should try MRTG plotting SNMP data."

[WG advised] "MRTG or Cricket to collect SNMP data from the boxes interfaces. Use MRTG or Cricket or NMIS to collect the stats from the switch/router they are connected to. Use OSU Flow-tools or Caida cflowd to collect netflow data from switches or routers. Use NTOP or other listener to record the traffic. The Performance Monitor tool is included with all versions of NT/Win2k/XP."

[NM said] "I use MRTG to graph the traffic on each port of our Cisco switches. It works beautifully. Of course this works just like a router using SMNP. This is also very handy when you may have a possible DoS attack coming from inside your network. You can see large spikes in traffic patterns.

[MM replied] "Apparently, MRTG and SNMP it is."

—End