[865] in resnet
Re: TCP/UDP Port use statistics software?
daemon@ATHENA.MIT.EDU (Todd Watson)
Wed Feb 20 21:28:08 2002
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <3C745A8C.6C57AE0B@southwestern.edu>
Date: Wed, 20 Feb 2002 20:25:18 -0600
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Todd Watson <tkw@SOUTHWESTERN.EDU>
To: RESNET-L@listserv.nd.edu
John, take a look at these:
FlowScan (http://www.caida.org/tools/utilities/flowscan/)
CoralReef (http://www.caida.org/tools/measurement/coralreef/)
Ipaudit (http://ipaudit.sourceforge.net/)
--
Todd K. Watson
Senior System & Network Administrator
Southwestern University, Georgetown, TX
tkw@southwestern.edu || TEL:512.863.1508 || FAX:512.863.1605
John Manly wrote:
>
> Hi there. I'm interesting in finding out what software packages folks here
> on RESNET are using to sniff/monitor the usage of their outbound traffic.
> In particular, I'm looking for a tool that will show bandwidth consumption
> by TCP/UDP port numbers. We already use MRTG and Etherpeek for aggregate
> information, but what I'm looking for is something that can break down the
> bandwidth by port number.
>
> Etherpeek can almost do this, but unfortunately you need to "label" or name
> every TCP port that you want it to track, otherwise it just groups all
> unlabelled ports into an "unknown" category together. Our problem is that
> we have lots of traffic on the network that we haven't been able to
> identify, and I'd like a tool that can tell us which ports are using the
> most so we can zero in on those first.
>
> For example, before we knew what it was, we had a lot of traffic on port
> 1214 (Morpheus/KaZaA). But it was difficult to learn that this port number
> was accounting for so much of our bandwidth because we lacked a tool that
> could tell us something like "Traffic on port 1214 is accounting for 60% of
> your total bandwidth."
>
> (Obviously I'm being a little sloppy here in not distinguishing between
> inbound and outbound bandwidth, but you get the idea.)
>
> So what to folks out there use to get this kind of information when they
> don't know in advance which ports might be causing them trouble?
>
> -- John W. Manly <jwmanly@amherst.edu>
> Systems and Networking, Amherst College
>
> ___________________________________________________
> You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives,
> go to http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
