Programs for bandwidth monitoring

Web-Based Programs

A good selection of web-based programs is available for monitoring complex server environments (e.g., Munin [14], Cacti [15], Zabbix [16], Zenoss [17], Bloonix [18], Nagios [19], and Splunk [20]). However, for single-user systems and special cases, ntop, BandwidthD, and darkstat are viable alternatives.

The ntop service collects data on system activities as a background task. Port 3000 provides access to an interface over which you call up relevant data. Ntop filters the data by IP address, protocol, host/domain, or transfer rate.

Figure 4 shows the statistics as a chart, and Figure 5 shows the throughput for each visiting host. For each computer, you see additional data such as the recognized operating system based on fingerprint detection. In Figure 5, for example, the tool recognized BSD-Unix as the operating system for linux-community.de .

Figure 4: Ntop provides data throughput statistics as a chart.

Figure 5: Data throughput per visited host plus additional info.

BandwidthD and darkstat are similar to ntop. To begin, install BandwidthD then tell it what you'd like to observe – that is, the subnets and network interfaces.

Upon restarting the service, the daemon dumps its statistics into /var/lib/bandwitdhd/htdocs/ , unless you specify otherwise. BandwidthD provides charts based on subnets and interfaces based on daily, weekly, monthly, and annual intervals.

Darkstat is small, portable, and lightweight. It listens on port 666 and analyzes data not only over time but also per hosts receiving or transmitting data. Figure 6 shows the analysis over time, which you can get consistently over the web browser. At this point, darkstat doesn't understand IPv6, however.

Figure 6: Darkstat shows a bar chart for incoming and outgoing data traffic.

The program starts only after you have successfully configured /etc/darkstat/init.cfg . There you specify the listening interface, the address range of the local network, and the IP address of the listening web interface. Follow up with START_DARKSTAT="yes" .

Safety Measures

With web interfaces, you will want to consider how much to allow outside access. Ntop provides the settings for Debian-based distributions, such as Ubuntu, in the /etc/default/ntop file. Note that it uses the loopback address 127.0.0.1 on port 3000 (GETOPT="-w 127.0.0.1:3000 ) by default.

For Darkstat set the IP address and port via /etc/darkstat/init.cfg . The value BINDIP="-b 127.0.0.1" specifies listening locally only. The BandwidthD program does not come with its own web interface. To access a graphical display, you can install a web server such as Apache or Nginx [21].