Monitor Internet bandwidth

The problem I find with counter applications is that once you have usage counts, or graphs, the inevitable question becomes "what is that" (when pointing at a total or peak on a graph).

I find the best way to investigate these things is through netflows and nfsen. A netflow is a record of a conversation: source, destination, ports, bytecounts, time. Think a wire capture where you don't care about the actual bytes transferred, just the aggregate information. By using something like nfsen to do analysis on a netflow collection, you can see who is talking to who, and by looking at ports, can usually make good guesses as to what they were doing. And best of all, you can go back in time to look at old conversations.

Here are my notes for installing nfsen on CentOS.

I don't have any solution to my iftop issue, but I found some useful alternatives that does almost the same (although none with per-host usage-graphs). While it seems iftop has to be monitoring the tun0 interface (otherwise it won't show any connected hosts), some of the others (pktstat, for instance) should be set up to monitor the underlying physical WAN-interface (em1 in my case).

Alternatives include (but are almost certainly not limited to) these programs, all in the FreeBSD ports collection, and all run in the terminal:

• pktstat (I find these args useful: pktstat -P -t -n -B -i em1)
• bmon (shows usage graph for each interface over time)
• trafshow
• bwm-ng

I found these from this site, where there are screenshots of each program.