A company has a High Speed internet connection (30 MB/s) which is enough for 10-15 computers. But for a week, there is almost no bandwidth "left", just checking email takes a long time or fails. Getting a website on screen is almost impossible. I checked with speedtest.net and now the speed is 3mb/s to 6 mb/s if not zero in the test time.

So the question is how I can monitor the in and out from the modem/router and analyze what IP take all the "juice" to take that bummer down in flame (or just find the program that make the internet choke). I have a Mac running 10.6.8 (the latest Snow Leopard release) and would like to better manage the network infrastructure and gain insight into how and when it becomes overloaded or performs poorly.

So in short, I need to track which IP or MAC address makes the most requests... And BTW, when there is no person at any computer (over the w-e) the line is fully used (as said by the internet provider (videotron) company) which is not supposed to happen!

NetUse monitor has been suggested by many, but I am still wondering about the features I need. Here is my problem and tell me how your software or other can help me.

  • Is there a way to get the LOG from the router ? and analyse it ?
    – menardmam
    Commented Mar 26, 2013 at 18:05
  • 2
    This isn't quite answerable yet since you haven't specified what router you use and what protocols it supports for logging (or SNMP). Yes, your Mac could run software that consumes the data that the router produces, but it's hard to recommend software without knowing some more details. Feel free to edit your question to read clearly what research you've done and what hardware / software needs are. (version of OS X and version of router software).
    – bmike
    Commented Mar 26, 2013 at 18:31
  • It's an AirPort Extreme Base Station link to a Videotron modem (high speed) on cable. Cannot tell more than that
    – menardmam
    Commented Mar 27, 2013 at 2:33
  • OSX version all over the place is 10.6.8
    – menardmam
    Commented Mar 27, 2013 at 2:34
  • Total rewrite of the question does not lead to more answers :-(
    – menardmam
    Commented Mar 27, 2013 at 21:00

4 Answers 4


Put a switch which can have ports configured in "span" mode so you can sniff all the traffic, (an old hub will also do the same job) between the router and the base station.

Plug in your laptop, install wireshark and sniff all the traffic. Then analyse.

The other tool I use is MRTG, but you will need to set up SNMP on the Airport or the "spanned" switch, and monitor for a few days.

You can definitely use SNMP with an Airport extreme as documented here.


For router traffic I use NetUse Traffic Monitor. If I identify a problem computer, I will start with Little Snitch on the computer.

  • Sure i will try it. I know little snitch but i am not there yet, i need to get the culprit first
    – menardmam
    Commented Mar 26, 2013 at 16:58
  • netuse specifically tell, you cannot track usage based on IP
    – menardmam
    Commented Mar 27, 2013 at 21:00
  • As of 2020, NetUse Traffic Monitor appears to be discontinued. Their website is still up (dated 2012), but the link to the AppStore is dead (as are most of the site's links).
    – Kal
    Commented Feb 18, 2020 at 6:25

I think that Proxifier can be useful for this case. You need create the correct filter for your connection and see the statistics of the traffic network.


Just span and capture with tcpdump and then analyze the traffic with Wireshark (tshark) for top talkers, one or two hosts will jump out immediately...

If you sniff the packets realtime you can almost always tell the top talkers they're the packets you see most often, usually it take me about 1min. to find the culprit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .