Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Users

determine host with most traffic

 

 

NTop users RSS feed   Index | Next | Previous | View Threaded


sclark at netwolves

Jan 28, 2010, 9:19 AM

Post #1 of 12 (1153 views)
Permalink
determine host with most traffic

Hi,

Is there a way to easily determine the host using the most bandwidth during a specific period?

In other words suppose I want to know the host that used the most bandwidth between 6am and 7am
two days ago and I have hundreds of host I am monitoring. Is there an easy way to determine
this?

Thanks,
Steve
--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


Ggatten at waddell

Jan 28, 2010, 9:20 AM

Post #2 of 12 (1111 views)
Permalink
Re: determine host with most traffic [In reply to]

Not if it was two days ago.

----- Original Message -----
From: ntop-bounces [at] listgateway <ntop-bounces [at] listgateway>
To: ntop [at] unipi <ntop [at] unipi>
Sent: Thu Jan 28 11:19:13 2010
Subject: [Ntop] determine host with most traffic

Hi,

Is there a way to easily determine the host using the most bandwidth during a specific period?

In other words suppose I want to know the host that used the most bandwidth between 6am and 7am
two days ago and I have hundreds of host I am monitoring. Is there an easy way to determine
this?

Thanks,
Steve
--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>


sclark at netwolves

Jan 28, 2010, 10:04 AM

Post #3 of 12 (1124 views)
Permalink
Re: determine host with most traffic [In reply to]

On 01/28/2010 12:20 PM, Gary Gatten wrote:
> Not if it was two days ago.
>
> ----- Original Message -----
> From: ntop-bounces [at] listgateway <ntop-bounces [at] listgateway>
> To: ntop [at] unipi <ntop [at] unipi>
> Sent: Thu Jan 28 11:19:13 2010
> Subject: [Ntop] determine host with most traffic
>
> Hi,
>
> Is there a way to easily determine the host using the most bandwidth
> during a specific period?
>
> In other words suppose I want to know the host that used the most
> bandwidth between 6am and 7am
> two days ago and I have hundreds of host I am monitoring. Is there an
> easy way to determine
> this?
>

What about the host that was using the most
bandwidth 2 hours ago.

--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


deri at ntop

Jan 29, 2010, 1:57 AM

Post #4 of 12 (1108 views)
Permalink
Re: determine host with most traffic [In reply to]

Steve
you need to access the RRD files for the hosts that you want to monitor
and sort them up. A python script running inside ntop would be the
perfect place for doing that. Would you be interested in writing such code?

Luca

On 01/28/2010 06:19 PM, Steve Clark wrote:
> Hi,
>
> Is there a way to easily determine the host using the most bandwidth
> during a specific period?
>
> In other words suppose I want to know the host that used the most
> bandwidth between 6am and 7am
> two days ago and I have hundreds of host I am monitoring. Is there an
> easy way to determine
> this?
>
> Thanks,
> Steve

_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


sclark at netwolves

Jan 29, 2010, 4:19 AM

Post #5 of 12 (1111 views)
Permalink
Re: determine host with most traffic [In reply to]

Hi Luca,

Yes - I have been looking at the rrd files and have some idea of how I could
do it outside of ntop, not that familiar with ntop architecture to quite
understand how to do it within ntop.

Also I won't know in advance what hosts I want to monitor. It is for
the situation where I am called by someone saying we had a spike in usage a couple
of hours ago, can you tell me which hosts were involved?

Can you point me to some part of ntop that shows a python script be run from within
ntop?


Regards,
Steve

On 01/29/2010 04:57 AM, Luca Deri wrote:
> Steve
> you need to access the RRD files for the hosts that you want to monitor
> and sort them up. A python script running inside ntop would be the
> perfect place for doing that. Would you be interested in writing such code?
>
> Luca
>
> On 01/28/2010 06:19 PM, Steve Clark wrote:
>> Hi,
>>
>> Is there a way to easily determine the host using the most bandwidth
>> during a specific period?
>>
>> In other words suppose I want to know the host that used the most
>> bandwidth between 6am and 7am
>> two days ago and I have hundreds of host I am monitoring. Is there an
>> easy way to determine
>> this?
>>
>> Thanks,
>> Steve
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop
>


--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


deri at ntop

Jan 31, 2010, 1:05 PM

Post #6 of 12 (1111 views)
Permalink
Re: determine host with most traffic [In reply to]

Steve
as soon as we complete the developments we'll write some docs. For the time being you can see some examples in the python/ directory part of ntop. You basically have to scan the directories where ntop saves the RRDs, use the RRD python library to read the traffic values and sort the values using the python sort facilities.

Cheers Luca



On Jan 29, 2010, at 1:19 PM, Steve Clark wrote:

> Hi Luca,
>
> Yes - I have been looking at the rrd files and have some idea of how I could
> do it outside of ntop, not that familiar with ntop architecture to quite
> understand how to do it within ntop.
>
> Also I won't know in advance what hosts I want to monitor. It is for
> the situation where I am called by someone saying we had a spike in usage a couple
> of hours ago, can you tell me which hosts were involved?
>
> Can you point me to some part of ntop that shows a python script be run from within
> ntop?
>
>
> Regards,
> Steve
>
> On 01/29/2010 04:57 AM, Luca Deri wrote:
>> Steve
>> you need to access the RRD files for the hosts that you want to monitor
>> and sort them up. A python script running inside ntop would be the
>> perfect place for doing that. Would you be interested in writing such code?
>>
>> Luca
>>
>> On 01/28/2010 06:19 PM, Steve Clark wrote:
>>> Hi,
>>>
>>> Is there a way to easily determine the host using the most bandwidth
>>> during a specific period?
>>>
>>> In other words suppose I want to know the host that used the most
>>> bandwidth between 6am and 7am
>>> two days ago and I have hundreds of host I am monitoring. Is there an
>>> easy way to determine
>>> this?
>>>
>>> Thanks,
>>> Steve
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] listgateway
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>
>
> --
> Stephen Clark
> NetWolves
> Sr. Software Engineer III
> Phone: 813-579-3200
> Fax: 813-882-0209
> Email: steve.clark [at] netwolves
> www.netwolves.com
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop

---
We can't solve problems by using the same kind of thinking we used when we created them - Albert Einstein

_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


Ggatten at waddell

Jan 31, 2010, 1:16 PM

Post #7 of 12 (1104 views)
Permalink
Re: determine host with most traffic [In reply to]

A couple hours is pretty easy. I'm not in front of ntop now, but I think in the "network traffic" report one can click on the graph and the top 3 hosts will be displayed for the period selected. There is also another traffic report that color codes the top hosts during each one hour period.

Ill be in the office Tuesday and can provide the exact url's to the reports I'm thinking of.

----- Original Message -----
From: ntop-bounces [at] listgateway <ntop-bounces [at] listgateway>
To: ntop [at] unipi <ntop [at] unipi>
Sent: Sun Jan 31 15:05:35 2010
Subject: Re: [Ntop] determine host with most traffic

Steve
as soon as we complete the developments we'll write some docs. For the time being you can see some examples in the python/ directory part of ntop. You basically have to scan the directories where ntop saves the RRDs, use the RRD python library to read the traffic values and sort the values using the python sort facilities.

Cheers Luca



On Jan 29, 2010, at 1:19 PM, Steve Clark wrote:

> Hi Luca,
>
> Yes - I have been looking at the rrd files and have some idea of how I could
> do it outside of ntop, not that familiar with ntop architecture to quite
> understand how to do it within ntop.
>
> Also I won't know in advance what hosts I want to monitor. It is for
> the situation where I am called by someone saying we had a spike in usage a couple
> of hours ago, can you tell me which hosts were involved?
>
> Can you point me to some part of ntop that shows a python script be run from within
> ntop?
>
>
> Regards,
> Steve
>
> On 01/29/2010 04:57 AM, Luca Deri wrote:
>> Steve
>> you need to access the RRD files for the hosts that you want to monitor
>> and sort them up. A python script running inside ntop would be the
>> perfect place for doing that. Would you be interested in writing such code?
>>
>> Luca
>>
>> On 01/28/2010 06:19 PM, Steve Clark wrote:
>>> Hi,
>>>
>>> Is there a way to easily determine the host using the most bandwidth
>>> during a specific period?
>>>
>>> In other words suppose I want to know the host that used the most
>>> bandwidth between 6am and 7am
>>> two days ago and I have hundreds of host I am monitoring. Is there an
>>> easy way to determine
>>> this?
>>>
>>> Thanks,
>>> Steve
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] listgateway
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>
>
> --
> Stephen Clark
> NetWolves
> Sr. Software Engineer III
> Phone: 813-579-3200
> Fax: 813-882-0209
> Email: steve.clark [at] netwolves
> www.netwolves.com
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop

---
We can't solve problems by using the same kind of thinking we used when we created them - Albert Einstein

_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>


sclark at netwolves

Feb 1, 2010, 4:56 AM

Post #8 of 12 (1103 views)
Permalink
Re: determine host with most traffic [In reply to]

On 01/31/2010 04:05 PM, Luca Deri wrote:
> Steve
> as soon as we complete the developments we'll write some docs. For the time being you can see some examples in the python/ directory part of ntop. You basically have to scan the directories where ntop saves the RRDs, use the RRD python library to read the traffic values and sort the values using the python sort facilities.
>
> Cheers Luca
>
>
Ok,

I have written a combination bash script piping rrd data into an awk script that does
the data accumulation and sorting over a selected time period shouldn't be too hard
to convert it to python.




>
> On Jan 29, 2010, at 1:19 PM, Steve Clark wrote:
>
>> Hi Luca,
>>
>> Yes - I have been looking at the rrd files and have some idea of how I could
>> do it outside of ntop, not that familiar with ntop architecture to quite
>> understand how to do it within ntop.
>>
>> Also I won't know in advance what hosts I want to monitor. It is for
>> the situation where I am called by someone saying we had a spike in usage a couple
>> of hours ago, can you tell me which hosts were involved?
>>
>> Can you point me to some part of ntop that shows a python script be run from within
>> ntop?
>>
>>
>> Regards,
>> Steve
>>
>> On 01/29/2010 04:57 AM, Luca Deri wrote:
>>> Steve
>>> you need to access the RRD files for the hosts that you want to monitor
>>> and sort them up. A python script running inside ntop would be the
>>> perfect place for doing that. Would you be interested in writing such code?
>>>
>>> Luca
>>>
>>> On 01/28/2010 06:19 PM, Steve Clark wrote:
>>>> Hi,
>>>>
>>>> Is there a way to easily determine the host using the most bandwidth
>>>> during a specific period?
>>>>
>>>> In other words suppose I want to know the host that used the most
>>>> bandwidth between 6am and 7am
>>>> two days ago and I have hundreds of host I am monitoring. Is there an
>>>> easy way to determine
>>>> this?
>>>>
>>>> Thanks,
>>>> Steve
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop [at] listgateway
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>
>>
>> --
>> Stephen Clark
>> NetWolves
>> Sr. Software Engineer III
>> Phone: 813-579-3200
>> Fax: 813-882-0209
>> Email: steve.clark [at] netwolves
>> www.netwolves.com
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] listgateway
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> ---
> We can't solve problems by using the same kind of thinking we used when we created them - Albert Einstein
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop
>


--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


mukom.tamon at gmail

Feb 1, 2010, 9:58 PM

Post #9 of 12 (1093 views)
Permalink
Re: determine host with most traffic [In reply to]

For finding out that kind of information at a particular time, I you
might want to consider deploying webtrisul. As far as i know, ntop
will give you top talkers over the period its been running.

But I am sure if you look at the various graphs ntop provides and do
some logical thinking, you may get what you are looking for. In
practice, I think, a top consumer is rarely a one-off occurrence but
rather a pattern (bittorrent etc) thus they will usually appear in
your top 10 and then by looking at the history for the various hosts,
you could make a reasonably accurate guess.

Tamon M.A.
_________________________
"A man owns nothing, not land or money, only his character, the
loyalty & courage in his heart" - Commander Chakotay - StarTrek
Voyager
[ICT Business Integration] - http://ibiztech.wordpress.com
[Leadership Lessons from Movies] - http://thbs.wordpress.com
[In Search of Excellence & Perfection] - http://perfexcellence.wordpress.com
[Technical How-Tos & Stuff-at-a-Glance] - http://techowto.wordpress.com





2010/1/28 Steve Clark <sclark [at] netwolves>:
> On 01/28/2010 12:20 PM, Gary Gatten wrote:
>>
>> Not if it was two days ago.
>>
>> ----- Original Message -----
>> From: ntop-bounces [at] listgateway <ntop-bounces [at] listgateway>
>> To: ntop [at] unipi <ntop [at] unipi>
>> Sent: Thu Jan 28 11:19:13 2010
>> Subject: [Ntop] determine host with most traffic
>>
>> Hi,
>>
>> Is there a way to easily determine the host using the most bandwidth
>> during a specific period?
>>
>> In other words suppose I want to know the host that used the most
>> bandwidth between 6am and 7am
>> two days ago and I have hundreds of host I am monitoring. Is there an
>> easy way to determine
>> this?
>>
>
> What about the host that was using the most
> bandwidth 2 hours ago.
>
> --
> Stephen Clark
> NetWolves
> Sr. Software Engineer III
> Phone: 813-579-3200
> Fax: 813-882-0209
> Email: steve.clark [at] netwolves
> www.netwolves.com
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


sclark at netwolves

Feb 2, 2010, 4:09 AM

Post #10 of 12 (1092 views)
Permalink
Re: determine host with most traffic [In reply to]

On 02/02/2010 12:58 AM, Mukom TAMON wrote:
> For finding out that kind of information at a particular time, I you
> might want to consider deploying webtrisul. As far as i know, ntop
> will give you top talkers over the period its been running.
>
> But I am sure if you look at the various graphs ntop provides and do
> some logical thinking, you may get what you are looking for. In
> practice, I think, a top consumer is rarely a one-off occurrence but
> rather a pattern (bittorrent etc) thus they will usually appear in
> your top 10 and then by looking at the history for the various hosts,
> you could make a reasonably accurate guess.
>
> Tamon M.A.
> _________________________
> "A man owns nothing, not land or money, only his character, the
> loyalty& courage in his heart" - Commander Chakotay - StarTrek
> Voyager
> [ICT Business Integration] - http://ibiztech.wordpress.com
> [Leadership Lessons from Movies] - http://thbs.wordpress.com
> [In Search of Excellence& Perfection] - http://perfexcellence.wordpress.com
> [Technical How-Tos& Stuff-at-a-Glance] - http://techowto.wordpress.com
>

Hi,

I put together a bash script in combination with awk to pull the largest
user out of the rrd files for a given time period.



>
>
>
>
> 2010/1/28 Steve Clark<sclark [at] netwolves>:
>> On 01/28/2010 12:20 PM, Gary Gatten wrote:
>>>
>>> Not if it was two days ago.
>>>
>>> ----- Original Message -----
>>> From: ntop-bounces [at] listgateway<ntop-bounces [at] listgateway>
>>> To: ntop [at] unipi<ntop [at] unipi>
>>> Sent: Thu Jan 28 11:19:13 2010
>>> Subject: [Ntop] determine host with most traffic
>>>
>>> Hi,
>>>
>>> Is there a way to easily determine the host using the most bandwidth
>>> during a specific period?
>>>
>>> In other words suppose I want to know the host that used the most
>>> bandwidth between 6am and 7am
>>> two days ago and I have hundreds of host I am monitoring. Is there an
>>> easy way to determine
>>> this?
>>>
>>
>> What about the host that was using the most
>> bandwidth 2 hours ago.
>>
>> --
>> Stephen Clark
>> NetWolves
>> Sr. Software Engineer III
>> Phone: 813-579-3200
>> Fax: 813-882-0209
>> Email: steve.clark [at] netwolves
>> www.netwolves.com
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] listgateway
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop
>


--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


deri at ntop

Feb 2, 2010, 4:56 AM

Post #11 of 12 (1100 views)
Permalink
Re: determine host with most traffic [In reply to]

> Hi,
>
> I put together a bash script in combination with awk to pull the largest
> user out of the rrd files for a given time period.
Do you want to share this script with the ntop community?

Luca
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop


sclark at netwolves

Feb 2, 2010, 5:29 AM

Post #12 of 12 (1091 views)
Permalink
Re: determine host with most traffic [In reply to]

On 02/02/2010 07:56 AM, Luca Deri wrote:
>
>> Hi,
>>
>> I put together a bash script in combination with awk to pull the largest
>> user out of the rrd files for a given time period.
> Do you want to share this script with the ntop community?
>
> Luca
> _______________________________________________
> Ntop mailing list
> Ntop [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
Hi Luca,

Certainly.
I am have set the scripts up to run automatically from a cron
job every hour. It queries the rrd file for the last hour for the ips
with the most bytesSent/bytesRcvd entries and writes the top 6 into a log
file that is for that day. It keeps 7 of these log files. That way if
I get a call that there was a spike in traffic I can review the log file
and then bring up the individual ip that exhibited the spike
in ntop to show the detailed usage for the
appropriate time period.

I am currently testing the scripts on FreeBSD and Linux. One of the
things I have noticed in preparing the scripts is that ntop a lot
of times will record rrd totals based on the mac instead of the ip,
so I have been running ntop with the -o option to make sure the
rrd files were based on the ip instead of the mac.

I need to clean the scripts up to make them a little more general.
Will post them after that is done.

--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve.clark [at] netwolves
www.netwolves.com
_______________________________________________
Ntop mailing list
Ntop [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop

NTop users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.