On Tue, 2007-01-23 at 12:11 -0600, Rick Sewill wrote: > On Tue, 2007-01-23 at 10:19 -0500, Bob Goodwin wrote: > > > > My ISP Wildblue limits me to 5 gig's upload and 17 down over a thirty > > day period. For the last nine months this has not been a problem, > > however last month they made a system change and said they were > > measuring usage more accurately. Now we are running perilously close to > > the limits for the last thirty days and I'm not certain why. > > > > We have four computers [FC6, Mac, and W2k] running on the wireless LAN > > which appears as eth0 to my computer. The system is comprised of the > > satellite receiver/modem, a Netgear wireless router, and some Linksys > > wireless bridges and/or adapters. Can someone tell me how I can track > > usage and determine how much each user is consuming? > > > > I do not have a good answer to this question, but I have suggestions. > > Each device should, hopefully, keep interface statistics. > > It might be possible to gather those statistics, periodically, using > snmp, if the device allows snmp. > > Another possibility depends on your configuration. Does all the traffic > between you and the ISP Wildblue go through a router or bridge you > control? It is a long-shot, depending on what devices you have and what > features they support, but, if the router or bridge you control, that is > the point of connection with Wildblue, supports VLANs, you might be able > to configure that device to have a VLAN for each of the devices on your > LAN, and then gather statistics based on VLANs. > I am a dummy. To have a separate VLAN for each device, you will need to have a router that routes between the VLANs. This setup is too complex for a home user. I apologize. If you have an intelligent switch, you might be able to get statistics for each port on the switch. This suggestion does not involve VLANs. > Another possibility is to use a program, such as iptraf, for monitoring > LAN traffic. "yum install iptraf" > > Please be certain to force promiscuous mode in any LAN traffic monitor > so you see all traffic that gets to the interface, and not just traffic > that is unicast to/from the PC, or traffic that is multicast or > broadcast, where you are running the LAN traffic monitor. > > Also, please be careful if you have any switches or bridges in your LAN > because a switch or bridge will "learn" which port on the switch or > bridge is the way to reach a unicast MAC address and will only send the > unicast packet out that port. Your PC, running the LAN traffic monitor > might never see the packet on any of its interfaces. > > It is best you run a LAN traffic monitor as close as possible to the > point of connection between your ISP and your local LAN. > > I would also be suspicious if your ISP is a Cable company. Your local > neighbors and you share the Cable to the Cable company. A few years ago > I had reason to put ethereal (wireshark) between my NAT/firewall box and > the Cable Modem box, I saw lots of traffic. Besides multicast and > broadcasts from my neighbors, the Cable company was sending a flood (I > hate to say it, but I thought it was a flood) of ARP requests for ranges > of IP addresses. I would hope the Cable company is not counting such a > flood of ARP packets against your limits because the Cable company would > be the one to generate the flood. It might be a good idea to look for > this condition, just in case. > > > Thanks. > > > > Bob Goodwin Zuni, Virginia > > > -- > Rick Sewill tel:+1-218-287-1075 mailto:rsewill@xxxxxxxxxxxx > 1028 7th St. N. mailto:rsewill@xxxxxxxxx > Moorhead, MN 56560-1568 ymsgr:rsewill sip:628497@xxxxxxxxxxxxxx > U. S. A. tel:+1-701-866-0266 xmpp:rsewill@xxxxxxxxxx > -- Rick Sewill tel:+1-218-287-1075 mailto:rsewill@xxxxxxxxxxxx 1028 7th St. N. mailto:rsewill@xxxxxxxxx Moorhead, MN 56560-1568 ymsgr:rsewill sip:628497@xxxxxxxxxxxxxx U. S. A. tel:+1-701-866-0266 xmpp:rsewill@xxxxxxxxxx
