Bandwidth monitoring

[Arta]

I administrate the server for the network in my house. It runs RRAS/DHCP - sharing the internet to the rest of the people in the house. Through observation (perhaps someone can confirm this?) it seems to me that when uploading on a cable connection, the download capacity of that connection is reduced. In other words, if someone in the house is uploading something, the internet becomes horribly slow for everyone.

So, on to the point: I'm looking for some application or service that I can install on the server which will monitor the bandwidth usage of all the hosts on the network, and graph that usage so I can see who is uploading most (and cause them immense pain ). If that tool could also be used to impose restrictions on the amount of upload bandwidth available to each host, that would be good too.

Does anyone know of such a tool?

[Kp]

Offhand, there are two possibilities as to why it slows down.  The first is that your ISP is trying to discourage you from using too much bandwidth and they're imposing some caps for you.  The second is that a noticeable portion of your downstream has become clogged with ACKs and/or other data necessary to the file transfer (even though it's going outbound, the sender still needs to know what's going on, which requires inbound...)

[Soul Taker]

While uploading, I still see 200-400kps downloads average.

[Arta]

The first is that your ISP is trying to discourage you from using too much bandwidth and they're imposing some caps for you.  

They've told me they're not doing that.

The second is that a noticeable portion of your downstream has become clogged with ACKs and/or other data necessary to the file transfer (even though it's going outbound, the sender still needs to know what's going on, which requires inbound...)

Could that really involve enough data to bring down a 1.5MB pipe? If I ping my ISP's default gateway while there's a lot of upload (15-20Kbps+) it usually times out or is very high: often above 3000ms. Upload capacity is 256KB, if that matters.

[Thing]

Take a peek at the SLA.  They never agree to provide you with full bandwidth in both directions at the same time.  You will need to pay more money to get that!

[Arta]

Well, that's what I thought Hence my question about monitoring software. If we can find out who's using the most upload (knowingly or otherwise) and spank them, this will no longer be a problem. Right now no one thinks it's them!

[Thing]

I like MRTG but it requires that the monitored machines be running snmp.  The monitor needs to have a web server installed to display the graphs.  It does work well on Winders machines.  Check your PM for an example.

[Arta]

I don't really know anything about SNMP - does windows come with a service that implements it? If not, is a decent client available?

[Hostile]

I don't really know anything about SNMP - does windows come with a service that implements it? If not, is a decent client available?

To install the SNMP service
Open Windows Components wizard.
In Components, click Management and Monitoring Tools (but do not select or clear its check box), and then click Details.
Select the Simple Network Management Protocol check box, and click OK.
Click Next.
Notes

To open the Windows Components Wizard, click Start, point to Settings, click Control Panel, double-click Add or Remove Programs, and then click Add/Remove Windows Components.
Certain Windows components require configuration before they can be used. If you installed one or more of these components but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components Wizard, click Components.
You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
SNMP starts automatically after installation.

[mynameistmp]

You mentioned to me earlier that you've got a node running mandrake (right?). Is that on the same (unswitched, unless you want to bust out some ARP techniques) segment as the computers you're interested in ?

[Adron]

Does all the traffic go through your server? It sounds like it'd be rather easy to just open a raw socket, receive all packets, check the source/dest ips and collect statistics of size per source computer?

[Arta]

You can do that with a raw socket? I have no experience writing listening applications with raw sockets, only client applications.

[Skywing]

You can do that with a raw socket? I have no experience writing listening applications with raw sockets, only client applications.

Yes, raw sockets receive all messages sent to the IP they're set to.  Note that you need administrator privileges to create a raw socket handle.

[Arta]

And receiving it in my raw socket won't stop it from being received by it's intended recipient?

[Skywing]

And receiving it in my raw socket won't stop it from being received by it's intended recipient?

Right.