Free software to monitor network traffic?

[evilsatan]

I setup a small network of 13 PCs, three of them are in a office and the other 10 are part of an IT suite. All internet usage is for browsing and emails only, there are no large downloads other than software updates and email attachments. Large attachments are very rare.

Due to the very low internet use they opted for a 50GB ISP package as it was a good deal. This month the 80% limit was reached which is abnormal, I am trying to trace where this data usage originated. The hardware is a BT Business Hub connected to a Netgear unmanaged switch to distribute the connection.

Is there any free software which can monitor the network and record downloads from each IP? I think this month may have been a one off but I would like to monitor the traffic from now on in case the limit is reached again. I do not want to impose data limits unless strictly necessary.

Cheers

[reverend]

Not sure of the software mate but did they all download the new service pack which was just released as on that many machines it would have used a fair bit of bandwidth.

May be worth looking at sticking a machine on running WSUS and then getting all the machines to pick up updates from that?

In terms of proxy not really sure on Windows stuff as only ever used ISA / Websense apart from trying Wingate years ago, don't even know if that exists any more - what about a Linux box with Squid maybe?

[koola2]

http://www.thinkbroadband.com/tbbmeter.html

How do I record usage from multiple computers?
If you have multiple computers, you can use tbbMeter to monitor all traffic on these computers. You will need to have an account registered on our website to be able to do this. Firstly, make sure you have installed the latest version of tbbMeter. Once installed, verify that you have tbbMeter set to record All Internet traffic (TCP/UDP) under the Type of Traffic to Display menu item. This will avoid it record any traffic between computers. Next, select Register from the menu and fill out the details with your username and password you have for our website. Click Validate and then Save Registration Changes. You will need to do this for each computer.
Once this has been completed, you will be able to see the collated results by logging in on our website and selecting the link to tbbMeter Stats at the top right of the My Profile page. Please note that it may take up to 30 hours before data is visible on the website.

[evilsatan]

I forgot to say they are running XP and updates have finished AFAIK so there are no new OS updates.

Will read through your posts and see what I can come up with.

Cheers

[Over Carl]

For free monitoring, you could set up an untangle box as a transparent bridge (piece of cake, router mode requires more thought/changes of network topology). Can do a heap of stuff apart from what you need. There is a freebie version which does ok, but I have the full paid for version for decent web filtering by category (free one is shite), and I also wanted the add on improved spam filter, ad integration and branding. I believe both free and paid for can email you daily/weekly/monthly reports but you get more detail if you look at the reports on the box. I've currently got one in production that I set up so I should be able to answer most simple config questions.

WSUS is a good idea for windows updates but these can also be cached by squid which can also cache a lot more.

Does your switch have a monitoring port (doubt it but you never know)?

Would your router support another router in bridged mode? I'm testing squid as a package on a pfsense router (I'm a linux noob so wouldn't know where to begin on installing squid on a fresh box, I just downloaded a pfsense cd and installed on a pc, then few mouse clicks to install packages). My testing isn't showing squid to be caching as well as I hoped - getting around 2-30% daily hit rates(install lightsquid package to monitor squid), but still even on my home connection it seems to serve between 200MB-1.5Gb from the cache daily (and serves these at up to 650Meg!!!!, probably faster if I upgraded the c2d 2.93 cpu as this gets maxed out).

pfSense also brings interesting monitoring options - I've got a whole heap of free monitoring packages on my pfsense box at home, ntop is most interesting but isn't totally stable on BSD (the base os) - often stops after about 2 weeks. However, you could install pflowd which allows the box to export cisco netflow (v5) data and collect on a pc - haven't got far with this yet but I know you can run ntop on windows. If it's of interest I have all of the packages installed at home so can provide screenshots. I should be able to help with this as well as I've got one as our main vpn router which will soon be upgraded to a failover cluster and one at home.

You could also look into an snmp monitoring solution to monitor bandwidth on each machine's nics. Nagios is free but a pita to set up. The only other one I've really messed around with is Orion Network Perfomance Monitor which is lovely but cost too much for me to get.

[Over Carl]

Here are some screenshots of the bits I reckon you could find handy, and implementing any of these will only cost you an old pc + another nic.

[Waka]

Someone has recommended this to me in the past although I've yet to get round to using it...
http://www.spiceworks.com/

[evilsatan]

Thanks for the replies, I am going to try tbbmeter first as I can access it from my office and it seems the most simple solution for this case.

I will have to look into Over Carls and Wakas suggestions too as they look very interesting