Ntop vs nagios to Monitoring Networking traffic

Personally I prefer cacti over MRTG. Cacti can do more than just switch/firewall port activity straight out of the box and scales a little better.

The advantage of nTop is that nTop can conceivably help you drill into network bumps and help you answer the question of "what is that?" You don't necessarily need netflows to make nTop work, it will be quite happy listening to a port mirror/monitor/RPA of the firewall's and working from that.

Personally I like something a little more robust than nTop. I use a fprobe/nfdump/nfsen setup (my setup notes). It lets you store the flows for a period of time, so you can go back after the fact and run more detailed analysis of the traffic for interesting periods.

I did this with a cron script, stores current value in a temp file then next time uses it to calculate bandwidth utilization since last run.

#!/bin/bash

email_address=""
router_ip=""

# 80% BANDWIDTH [ (384000bps) 48,000Bps ] - 20% = 38,400 Bps
alertBW="76800"

lastBWFile="/var/log/ciscoGW.log"
lastBW=`cat $lastBWFile | awk '{print$2}'`
lastTime=`cat $lastBWFile | awk '{print$1}'`

curBW=` snmpget  -c snmap_name -v 1 $router_ip IF-MIB::ifOutOctets.2  | awk '{print$4}'`

let diffBW=$curBW-$lastBW
#echo "Diff BW: $diffBW"
timeNow=`date +%s`
let diffTime=$timeNow-$lastTime
let alertBW=$alertBW*$diffTime

echo "$timeNow $curBW" > $lastBWFile

if [ $diffBW -gt $alertBW ]; then
#       echo "Over limit!"
        echo "Bandwith used over $diffTime seconds: $diffBW" | mail -s "BANDWIDTH OVER LIMIT!!!!" $email_address
fi

Since I was more interested in actual peaks I've since moved to using rrdtool:

#start 15 minutes ago
#end 5 minutes ago since rrdtool queries every 5 minutes 
rrdtool fetch $FROM MAX -s -900 -e -300