All I want is to measure traffic by port!!

[chris[uk]]

All I want is to measure traffic by port!!

E.g. Graph for port 80 / 443 etc...... put them all on the same graph and make it look pretty (for boss)

I have to use Windows 2000, non standard is not allowed in the corporate environment. This tool looks great (got 1 script working with w2k) and I am sure does the job fantastically on Unix.

I have spent ages looking for a tool to do this with no success, does anyone know of anything that could do this? or a script, perl or vbs that works with win32?

Help much appreciated!

Chris.
[/list]

[bulek]

Like here: http://www.caida.org/tools/utilities/flowscan/ ?

You can do it at least in two ways: using netflow statistics on cisco routers or sniffing LAN segment with some utility. I'm affraid I don't know any solution working on Windows but maybe you can use some other platforms as a polling agents leaving Cacti on Windows.

Flowscan is one of tools utilizing netflow statistics for generating rrd files and graphs.

In case of sniffing tools you can use several instances of tcpstat with filtering on different port each of them. You can the read stats from file. Maybe Ntop can export sniffed data for you (oh yea... this one works on Windows platform as well).

- bulek

[chris[uk]]

will check this out thx

[met]

I have assembled a quick hack that uses a small perl program to summarize netflows stats on MySQL. Cacti then uses a small script to retrieve and plot per prot statistics. Its main problem is that it is not as stable as I wish, I think it need some more tuning and I don't have much time now.

I coul post some scripts, but they are missing any documentation.

Regards,

Marco.

[JustinHoMi]

Please do post them

[phriday613]

dude, just use the "Get custom TCP connections" data source.. when you "edit data", just put in the port number, and ur all set!

[bulek]

"Get custom TCP connections" just counts the number of connections established to/from cacti host for given TCP port number (btw, it is not too accurate and can report more connections than the real ones). It does not measure the traffic in any way.

- bulek

[Guest]

For *nix enviorments, there is NeTraMet. It works like snmp and you can make it output any tcp info you like (you just have to figure out how to bend the config). You can also place different agents in your network to gather multiple stats you you have more net connections. If i remember corectly, there was a NeTraMet version for dos, but there was no such thing as a win32 version.

[manaf]

if you are using Cisco take a look into NBAR