Limit Windows XP machine’s bandwidth between 9AM – 11PM

What kind of routers are you using? It sounds like you're just using SOHO type routers? You might want to look at getting better routers and switches with management built in and monitorable through SNMP.

That said I'd also put in a proxy server that can log activity and block certain traffic. Proxying can help some of your speed woes, blocking can limit others.

Upgraded routers can also handle traffic shaping and limiting, as well as QoS. If you must do it on the "cheap", you could start using a Linux box (there are several turnkey solutions) to do the traffic monitoring and shaping. Install, configure, set it as the gateway for everyone's system to route through. An inexpensive box can also do the proxying work for you, and you could have options for VPN access.

We ran a SquidGuard box for awhile to filter and proxy traffic. Turned out it was also pretty good at helping track down certain malware on the network when we filtered for certain broadcasts that were scattering through the routing tables from a particular (infected) client. It was also great for getting browsing activity reports.

Just make sure any filtering or whatnot is allowed in your policies and employees are made aware of network monitoring. Sometimes it's the law, other times it's just a nice courtesy to your users to be reminded they're using company resources, not personal resources.

I recommend using libvirt for managing your KVM virtual machines. It makes the whole thing much easier than with just plain QEMU/KVM and provides also nice CPU, IO and network statistics. You will like tools such as virt-top and virt-manager which work on top of the libvirt framework.

To collect the virtual machine interface statistics from a script, you could use virsh command line interface to libvirt or some of the language APIs. The format of the virsh command is as follows:

virsh domifstat VMNAME IFNAME

..where VMNAME is the name of your virtual machine and IFNAME is the name of a (virtual) network interface. To find out a name of a network interface you can do:

virsh dumpxml VMNAME

In the resulting XML output, look for your network interface definition(s). Look for a line such as follows:

<target dev='vnet0'/>

In this case your IFNAME would be "vnet0".

Alternatively you could use a statistics collection daemon, such as collectd which has support for monitoring libvirt statistics, but a simple shell script which some times stores the output of "virsh domifstat" is maybe enough in this case.