Anyone knows of a good tool that can report network traffic along with
how much bandwidth each user consumed?

On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:

> Anyone knows of a good tool that can report network traffic along with
> how much bandwidth each user consumed?

You don't provide much detail, however I suppose that by "each user" you
mean "each ip/mac address/host", otherwise things become complicated.
Depending on your requirements, you may be interested in one of ntop,
tcpflow, ipaudit, ipband, iptraf, etherape, pmacct, tcptrack, trafd,
trafshow, ttt, ipac-ng, ipcad ... to limit the discussion to stand-alone
programs. Otherwise, things can get arbitrarily complex, and you'll
probably need some real network management system.

If you have netflow data, you have even more choices (just do "eix -S
netflow" to get started).

On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:

> Anyone knows of a good tool that can report network traffic along with
> how much bandwidth each user consumed?

You don't provide much detail, however I suppose that by "each user" you
mean "each ip/mac address/host", otherwise things become complicated.
Depending on your requirements, you may be interested in one of ntop,
tcpflow, ipaudit, ipband, iptraf, etherape, pmacct, tcptrack, trafd,
trafshow, ttt, ipac-ng, ipcad ... to limit the discussion to stand-alone
programs. Otherwise, things can get arbitrarily complex, and you'll
probably need some real network management system.

If you have netflow data, you have even more choices (just do "eix -S
netflow" to get started).

pk wrote:
> On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:
>
>> Anyone knows of a good tool that can report network traffic along with
>> how much bandwidth each user consumed?
>
> You don't provide much detail, however I suppose that by "each user" you
> mean "each ip/mac address/host", otherwise things become complicated.

Sorry for that, I should have explained better. By "user" I mean the
actual user ID on the system, not a host or NIC. The exact details look
like this: I get an email from the IT department that machine X
generated 2TB of outgoing traffic in 1 week. Now I already know how
this traffic was generated; Bit Torrent. But it's a machine with about
150 users, so I'd like a way to find out which user is responsible for
the traffic peak.

I don't think I need traffic shaping or quotas. Just a means to see how
much bandwidth each user consumed so I can simply email them to throttle
their downloads and uploads in the future.

I guess actual per-user traffic shaping would be quite complicated, so
that's why I asked about a tool that can give the info I need.

pk wrote:
> On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:
>
>> Anyone knows of a good tool that can report network traffic along with
>> how much bandwidth each user consumed?
>
> You don't provide much detail, however I suppose that by "each user" you
> mean "each ip/mac address/host", otherwise things become complicated.

Sorry for that, I should have explained better. By "user" I mean the
actual user ID on the system, not a host or NIC. The exact details look
like this: I get an email from the IT department that machine X
generated 2TB of outgoing traffic in 1 week. Now I already know how
this traffic was generated; Bit Torrent. But it's a machine with about
150 users, so I'd like a way to find out which user is responsible for
the traffic peak.

I don't think I need traffic shaping or quotas. Just a means to see how
much bandwidth each user consumed so I can simply email them to throttle
their downloads and uploads in the future.

I guess actual per-user traffic shaping would be quite complicated, so
that's why I asked about a tool that can give the info I need.

Nikos Chantziaras pisze:
> pk wrote:
>> On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:
>>
>>> Anyone knows of a good tool that can report network traffic along with
>>> how much bandwidth each user consumed?
>>
>> You don't provide much detail, however I suppose that by "each user" you
>> mean "each ip/mac address/host", otherwise things become complicated.
>
> Sorry for that, I should have explained better. By "user" I mean the
> actual user ID on the system, not a host or NIC. The exact details look
> like this: I get an email from the IT department that machine X
> generated 2TB of outgoing traffic in 1 week. Now I already know how
> this traffic was generated; Bit Torrent. But it's a machine with about
> 150 users, so I'd like a way to find out which user is responsible for
> the traffic peak.
>
> I don't think I need traffic shaping or quotas. Just a means to see how
> much bandwidth each user consumed so I can simply email them to throttle
> their downloads and uploads in the future.
>
> I guess actual per-user traffic shaping would be quite complicated, so
> that's why I asked about a tool that can give the info I need.

You can use --uid-owner for markng per-user traffic and in qos match it
to correct policy.

Regards,
Pawel Mojski

Nikos Chantziaras pisze:
> pk wrote:
>> On Monday 5 May 2008 12:52, Nikos Chantziaras wrote:
>>
>>> Anyone knows of a good tool that can report network traffic along with
>>> how much bandwidth each user consumed?
>>
>> You don't provide much detail, however I suppose that by "each user" you
>> mean "each ip/mac address/host", otherwise things become complicated.
>
> Sorry for that, I should have explained better. By "user" I mean the
> actual user ID on the system, not a host or NIC. The exact details look
> like this: I get an email from the IT department that machine X
> generated 2TB of outgoing traffic in 1 week. Now I already know how
> this traffic was generated; Bit Torrent. But it's a machine with about
> 150 users, so I'd like a way to find out which user is responsible for
> the traffic peak.
>
> I don't think I need traffic shaping or quotas. Just a means to see how
> much bandwidth each user consumed so I can simply email them to throttle
> their downloads and uploads in the future.
>
> I guess actual per-user traffic shaping would be quite complicated, so
> that's why I asked about a tool that can give the info I need.

You can use --uid-owner for markng per-user traffic and in qos match it
to correct policy.

Regards,
Pawel Mojski

On Monday 5 May 2008 16:19, Nikos Chantziaras wrote:

> Sorry for that, I should have explained better. By "user" I mean the
> actual user ID on the system, not a host or NIC. The exact details look
> like this: I get an email from the IT department that machine X
> generated 2TB of outgoing traffic in 1 week. Now I already know how
> this traffic was generated; Bit Torrent. But it's a machine with about
> 150 users, so I'd like a way to find out which user is responsible for
> the traffic peak.
>
> I don't think I need traffic shaping or quotas. Just a means to see how
> much bandwidth each user consumed so I can simply email them to throttle
> their downloads and uploads in the future.
>
> I guess actual per-user traffic shaping would be quite complicated, so
> that's why I asked about a tool that can give the info I need.

Then you may be interested in iptables owner match, see

http://iptables-tutorial.frozentux.n...tml#OWNERMATCH

Of course, what to do once you match the traffic is up to you. And if the
next step is limiting the bandwidth, then I guess you'll have to read lartc
anyway.

On Monday 5 May 2008 16:19, Nikos Chantziaras wrote:

> Sorry for that, I should have explained better. By "user" I mean the
> actual user ID on the system, not a host or NIC. The exact details look
> like this: I get an email from the IT department that machine X
> generated 2TB of outgoing traffic in 1 week. Now I already know how
> this traffic was generated; Bit Torrent. But it's a machine with about
> 150 users, so I'd like a way to find out which user is responsible for
> the traffic peak.
>
> I don't think I need traffic shaping or quotas. Just a means to see how
> much bandwidth each user consumed so I can simply email them to throttle
> their downloads and uploads in the future.
>
> I guess actual per-user traffic shaping would be quite complicated, so
> that's why I asked about a tool that can give the info I need.

Then you may be interested in iptables owner match, see

http://iptables-tutorial.frozentux.n...tml#OWNERMATCH

Of course, what to do once you match the traffic is up to you. And if the
next step is limiting the bandwidth, then I guess you'll have to read lartc
anyway.

Nikos Chantziaras <realnc@arcor.de> wrote:
> Sorry for that, I should have explained better. By "user" I mean the
> actual user ID on the system, not a host or NIC. The exact details look
> like this: I get an email from the IT department that machine X
> generated 2TB of outgoing traffic in 1 week. Now I already know how
> this traffic was generated; Bit Torrent. But it's a machine with about
> 150 users, so I'd like a way to find out which user is responsible for
> the traffic peak.

If live statistics are ok, try nethogs.

Marc