ok the time has come....our company recently hired 10 mor eemployees all of which spend most of their time scavenging on the internet.
Most of them downloaded the metacafe software which uses port 80 to download movies n shit....etc...
I need....a simple solution (for my simple brain to understand)
that will monitor internet bandwidth being used by an individual.
Unfortunatly i do not use a workstation / computer as a passthrough for internet.
I have a router which has SNMP protocol capabilites...which connects to a 26 port switch. And then everyone connects to that switch.
So i think im stuck with trying to find a nice software that will connect and work with the SNMP protocol of the D-Link Router im using.
I was reading abt windows 2003 built in SNMP. Says i have to define traps n stuff....im not sure if it will help me in this situation.
So give me some ideas guys? should i re arrange my network topology?
Or shall i find something that will work well with my router? SNMP
Or do i have to use a workstation as a passthrough point to the Internet?
I need some answers from the pros....IAN, u mentioned earlier abt Proxy Transparency n stuff....i beleive that involves a workstation between the Internet gateway and the clients...acting as apassthrough right...(want that to be my last option if possible)
im looking forward to implementing an SNMP software that will read information from the router. MaaaD Dave the way you descrive your existing setup i dont think you can find out indivisual user bandwidth use. You will need a proxy or firewall to do that. Another option would be to install an agent on the clients that will track bandwidth usage per machine and send you a report. a much cheaper way is to send out an email (after mangement approval) with a stern langauge about bandwidth use and how all users will be accountable (make it sound like you know who is doing it) .. and see the usage drop. If it doesnt then either you got an employee who doesnt care, or maybe an infected machine ? DaveDXB Current situation. 1. I have already informed all employees about high Internet bandwidth issue. No one gives a damn. 2. Higher level management may alreaady know who it is....thing is...different employees come and go, therefore i cant keep a track on all of them. I would rather log the frequently visited website with high usage and see if it needs to be blocked or not e.x "iTunes", "metacafe" etc. 3. Most of the laptops are private. I am not allowed to install any spying software or whatever on their laptops....they freak out lol. ========================================== I have recently read abt SNMP Protocol softwares which u can download and install on any computer. It then starts reading the reports of you SNMP enabled router (D-Link) I specify the location of your router to your software...and it starts logging. I noticed there are many different SNMP supported software out there that have different logging capabilites....some have graphs...some log by IP .... some really damn complicated needing SQL database n stuff....So i was just wondering if any of u have already used any similar software or so. I also read Windows 2003 has this SNMP software built in.....Im not sure of its logging capabilites....yet to find out.... -----My first step would be to figure out SNMP built in windows 2003. -----Then perhaps decided if i should use a 3rd party SNMP software which is more user friendly and has more functionality then the Windows 20003 one. -----If all fails then i guess ill have to do it the hard way and set up a proxy or whatever...(which ive never done before) (IAN is a great source of help regarding TRANSPARENT PROXY n stuff...) but that too much for me.... ============================================ so i guess it comes down to two choices....easy way and the hard way easy way would be to find a suitable way to read and logg reports from my router using the SNMP Protocol system. If that doesnt help me determine which client is bombarding the place then ill have to to it the hard way....professional way...i have to study for this lol. ahamed i donot why do you have to get the logs & make reports. Simply shut them up. SNMP is the easy method though a long process. You can get an old pc with a Proxy software (CCProxy for instance). And configure it according to the bandwidth you want. Tell users, you had to change the setup of the network & put the proxy server ip in the user comptuers. Now, their bandwidth is limited. But for logs.,.n reports.. u need to install applications on their computers, which unfortunately u cant :( DaveDXB Thanks Ahamad...thats an idea!
After long hours of thinking and consultation with a professional i know who stays in SAIF Freezone sharjah.
It comes down to this...
Ill simply buy a router with built in firewall capabilities....
I was suggested to get the SONIC WALL Router.
That has built in managment software that RUNS within!!!
Its a module of its own from a starting price of 1,500 AED for 5 users.
My friend said he already implemented it in 3 medium sized companies and recommends it. This would be an easier choice rather than having a worstation act as a gateway and can avoid all the setting and conifurations. DaveDXB
- ahamed wrote:
i donot why do you have to get the logs & make reports. Simply shut them up.
SNMP is the easy method though a long process.
You can get an old pc with a Proxy software (CCProxy for instance).
And configure it according to the bandwidth you want.
Tell users, you had to change the setup of the network & put the proxy server ip in the user comptuers.
Now, their bandwidth is limited. But for logs.,.n reports.. u need to install applications on their computers, which unfortunately u cant :(
i already did that...except that i also have a computer running as a file server where everyone backs up theyre files on...So when i decreased the speed....backing up and copying file and printing became VERY SLOW!
So i had to remove the speed constraints...(sorry for not mentioning that earlier)
1 Dubai Jobs .com The First Place to Find a Job in Dubai
shinydiscoballs Setup the DHCP server so it has IP address reservations for MAC addresses on the network that correspond to the known (or suspected) offending users. This allows YOU to control who get's what IP, which makes the subsequent process of tracking the offending bandwidth hogs in various log files much easier. Firewall's work both ways.. so implement outbound blocking for everything except the essential ports. If someone needs to use something, put in a rule for their source IP (which you now control) to allow the outbound traffic. This will be much easier if you buy a real firewall and not a $50 domestic one. Port 80 abuse is hard to deal with, but you'll have to use an outbound proxy for port 80 traffic (on something other than a file/print server) to get any visibility of where traffic is going. "Squid" proxy on any Linux distro is a good solution. Micro$hite has proxy software too, but i've always found it to be dumbed down and less flexible. "AWstats" is an easy to use open-source log processing tool that can take squid logs and show you who's been visting which places on the net and start to give you indications on their bandwidth usage. SNMP is a red herring. It'll show you cummulative bandwidth, but nothing by user/ip source. It's only designed for remote monitoring equipement (meaning "is it online and working") but not analysis which is done post-event using log processing tools. SDB DaveDXB hmmm so choices are -linux server using squid -CCproxy -And i was thingking of using a server as a NAT server.... The gateway will be connected to windows 2003 acting as a NAT server, and from ther a switch will be connected...and then the users to the switch....so that means if the computer power goes down lol...all the internet and network goes down. I still in the process of learning how to use windows 2003 as a passthrough nat server... Ill try CCproxy...seems to be the easiest....then move on to NAT....and finally linux.... thanks for the fedback guys. DaveDXB What a headache I spent all day trying to figure all this out I finally got ccproxy installed and running but i didnt know how to setup the two network interface cards. Then i did a little reading on Internet Connection Sharing (ICS) and Network Address Translation (NAT) routing. Really cool stuff i had to say....it was said that ICS is crappy and not to be used for more than 3 clients...its easy to setup but has limited functionality comparing to NAT routing. So now i finished setting up the NAT routing...lets see if it works and most importantly if it will support my needs such as weblogging n stuff..... if not...then ill have to go back and figure out how to make CCproxy work. DaveDXB oki figured out how to configure a NAT sever.... unfortunatly it doesnt support monitoring....it has basic blocking n stuff but not monitoring or analysing.... I was about to install CCproxy after for some reason i decided to install ISA 2004 lol.....now i really got myself into a mess... So now im trying to make ISA work...lets see how it goes. HP
- DaveDXB wrote:
What a headache
I spent all day trying to figure all this out
I finally got ccproxy installed and running
but i didnt know how to setup the two network interface cards.
Then i did a little reading on Internet Connection Sharing (ICS)
and
Network Address Translation (NAT) routing.
Really cool stuff i had to say....it was said that ICS is crappy and not to be used for more than 3 clients...its easy to setup but has limited functionality comparing to NAT routing.
So now i finished setting up the NAT routing...lets see if it works and most importantly if it will support my needs such as weblogging n stuff.....
if not...then ill have to go back and figure out how to make CCproxy work.
why do u not block the the web site of dubai forums at your own office :P esteve if you have not sorted it i will fix your problem but it will cost ya DaveDXB :cry: i pay u to teach me buddy. I did alot of studying and testing...its funny how someone can show it to u and explain it in 5 minutes...rather then spending a whole month or so figuring it out urself. Nways, i got the NAT and Route type of conections figured... Now ive installed ISA 2004 and the damn thing is a pain in the azz.... So you think u know a thing or two abt ISA 2004? Pls enlighten me with a brief description of ur skills and background....i may look forward to being ur student. e-lad Its an easy matter with OpenBSD with squid :D DaveDXB yeah i'll have to upgrade my skillz there