Realtime Bandwidth Monitoring

[psyllex]

Hello all! I'm trying to find a solution that offers real time 'graphical' bandwidth monitoring. I've looked at Naigos, Icinga, PNP, Check_MD. None are what I'm looking for precisely. The SYSTEM MONITOR that comes with Ubuntu is actually perfect if you take away the CPU History and Memory graphs. But I would like something I could perhaps have 4-5 graphs that represent routers,switches or servers all on one page or app. I've found bmon and ifsat but both aren't as 'graphical' as I would like. I've looked ntop but haven't gotten very far with it. Does anyone have any suggestions?

[psyllex]

83 views and no replies? LOL. I found darkstat which works pretty well. It only allows me to view on node at a time, but it's pretty good. I need to find a way to include the refresh rate....right now it's every 5 seconds but I'd like to get it to 1/sec.

[psyllex]

118 views and still no responses...I'm getting concerned here!

[tgalati4]

apt-cache search network monitor

Start installing some of these older monitor tools and find one that you like.

[psyllex]

apt-cache search network monitor

Start installing some of these older monitor tools and find one that you like.

I've done quite a bit. Ifstat Ipstat bmon prtg mrtg cacti nagios icinga ntop etherape etc. None run truly in real time. So my search continues. I'm thinking about just modifying the source of darkstat to work the way I want.

[tgalati4]

What is considered realtime to you? Monitoring is a tradeoff between the timeslice and interference with network throughput. You might have to go with a real-time kernel or at least one with smaller timeslices, or an instrumented/profiled kernel to get the data that you are looking for. For that, there are other tools like dtrace that can give you very fine granularity.

What is the purpose of the monitoring? QoS tweaks, DoS analysis, Web server performance?

[psyllex]

What is considered realtime to you? Monitoring is a tradeoff between the timeslice and interference with network throughput. You might have to go with a real-time kernel or at least one with smaller timeslices, or an instrumented/profiled kernel to get the data that you are looking for. For that, there are other tools like dtrace that can give you very fine granularity.

What is the purpose of the monitoring? QoS tweaks, DoS analysis, Web server performance?

We're monitoring bandwidth performance specifically. And mostly we can get fine stats from programs like ifstat, but I need it graphically displayed. The closest thing is darkstat.

let me ask a question. If I'm monitoring a router from darkstat binding it to the subnet/mask i.e.: 192.168.1.1.0/255.255.255.0 is it a solid representation of the traffic if I'm not seeing any in traffic and only out traffic? Being that I'm trying to monitor the whole network through a router which is simply forwarding the packets along? In fact isn't it kind of fool hardy to try and monitor a network through a router as it's sole purpose is to forward packets. The only way we would see in traffic is if packets were addressed specifically to the router...am I correct? I appreciate the help.

[tgalati4]

There are hardware/software solutions that are designed to do just that.

http://www.ixiacom.com/

Trying to turn a generalized desktop/server operating system into a router performance monitor might be a stretch without recompiling the kernel and the TCP/IP stack and using instrumentation to pull out the data that you are trying to measure.

iperf, ifstat, and other userspace tools will give you some insight into performance, but dedicated measurement solutions are designed to get the data with little interference from the instrument itself.

Perhaps there is a linux kernel and a set of tools bundled into a "network performance measurement distro"? I don't know of one, but perhaps some searching will find one.

I'm familiar with the industry tools, but not with recreating them in software alone in linux.

[psyllex]

Yes we're kicking around the idea of diving into the kernel and pulling things out. Unfortunately I'm partner with a network guy who thinks he's Wozniak. I know how long and difficult that will prove, but he either: doesn't have a clue, or is lying to everyone to try and make himself look good. LOL...gotta love those types. Ambition is one thing but diving into the kernel and creating a program that pulls bandwidth data and sends it via some form to a web browser for a graphical interface that works in realtime....is not a week long process. I am interested in doing this in the long term as I could see it being a decent tool to have around. I cracked my linux kernel programming guide up. I have seen a few tools that can do it like Netflow Analyzer or NST but they're integrated into a big page. We night something light that can be embedded in a separate page. So it's kinda of specialized. If we do build it I will post it up in GitHub for all to share. Cheers.

[tgalati4]

That's encouraging. I'm surprised that their isn't a distro that is specialized for network performance measurement. I haven't looked, but I did work next door to iXia and took a factory tour, so I've seen what real network monitoring looks like. If you can get similar functionality with a few network cards, a PC and an instrumented kernel, then that would be helpful to the community. It's not a trivial problem when you start getting into the details.

What specifically are you trying to measure? What is the network topology? LAN performance, WAN performance? Website service requests?