Suggestions for a Comprehensive Network Monitoring Solution

Question

We are looking for something that can provide a view (GUI or CLI) of all network traffic on our network. We are running all Apple computers, with SonicWall routers. Essentially, we'd like to have the ability to see what someone is looking at on the Internet when we notice that they are exceeding a regular traffic quota.

I know we could use wireshark; but, I'm not sure if we can run that on the entire network and still be able to sift through all of the data that it would return, in a reasonable amount of time.

Answer 1

The above-suggested Rubbernet's domain name appears to be parked, and no product information available. Perhaps they've gone the way of Lithium (which went 'fut' a couple of years ago).

While I do not have enough, recent, or long-term experience with InterMapper, I know they have been around for quite a long time, so you'd be less likely to run into issues like the above (putting resources and time into a product that disappears a few years down the road).

There are, of course, lots of open-source solutions, which require various levels of comfort and competency in setting them up. However, perhaps you might want to take a look at InterMapper?

Answer 2

Rubbernet

You can do this with Rubbernet. Install the daemon on all the Macs you want to monitor, then remotely monitor the apps (and the servers) that are using bandwidth.

^{Note that this screenshot is from an older version of the software and doesn't show the reverse IP lookup — it is possible to show the domain rather than the IP.}

• Real-time network dashboard

  Rubbernet provides real-time monitoring so you can keep an eye on the exact state of your live network connections.

• Remote monitoring

  Monitor all computers on your network from one Rubbernet instance on your Mac. No need to get up and open Rubbernet on a remote Mac to see its network statistics.

• Multi-user support

  Have multiple user accounts on your Macs? Rubbernet automatically assigns every incoming and outgoing connections to the users they belong to.

• App bandwidth usage

  Rubbernet provide a breakdown of per-app network usage, so you can quickly detect apps that phone home, connect to certain servers without your knowledge, or blame the app that's slowing down your network.

• Live graphs

  Real-time charting displays download and upload transfer rates for all active apps on all monitored Macs

• One-click enable/disable

  Unlike other network monitoring tools, there is no complicated setup. It takes just a second to install or uninstall the necessary tools for Rubbernet to work. After that, they sit quietly in the background and provide the app with live data with minimal resource consumption.

Answer 3

Another suggestion for OS X would be ntopng, which has a nice web GUI interface and will show you bandwidth utilization per node on your LAN. I have only run this tool on a Linux box before, but the website states it can run on OS X or Windows just as well as it does Linux. Might be worth a look.

Here is a list of things it can do (from website)

• Sort network traffic according to many protocols
• Show network traffic and IPv4/v6 active hosts
• Store on disk persistent traffic statistics in RRD format
• Geolocate hosts
• Discover application protocols by leveraging on nDPI, ntop’s DPI framework.
• Characterise HTTP traffic by leveraging on characterisation services provided by block.si. ntopng comes with a demo characterisation key, but if you need a permanent one, please mail info@block.si.
• Show IP traffic distribution among the various protocols
• Analyse IP traffic and sort it according to the source/destination
• Display IP Traffic Subnet matrix (who’s talking to who?)
• Report IP protocol usage sorted by protocol type
• Act as a NetFlow/sFlow collector for flows generated by routers (e.g. Cisco and Juniper) or switches (e.g. Foundry Networks) when used together with nProbe.
• Produce HTML5/AJAX network traffic statistics

http://www.ntop.org/products/ntop/