Monitor traffic on the local network. Programs for monitoring Internet traffic and their features

• Easy to set up!
• Real-time consumption charts.
• Control all devices from one PC.
• Notification when the limit is exceeded.
• Support for WMI, SNMPv1/2c/3 and 64-bit counters.
• Determine who is downloading and from where.
• Check the provider!

"10-Strike: Traffic Accounting" is simple program to control the flow of traffic on computers, switches, servers in the network at the enterprise and even at home (3 sensors can be monitored for free in the trial version even after the 30-day trial period has expired). Monitor volumes incoming and outgoing consumed traffic on computers throughout your local network, incl. when accessing the Internet.

The program constantly collects statistics from network hosts on incoming and outgoing traffic and displays in real time the dynamics of changes in the data transfer rate on network interfaces in the form of graphs and tables.

With our accounting software, you can detect dishonest users who spend a lot of Internet traffic in your organization. Violation of labor discipline by employees leads to decrease in labor productivity. The simplest analysis of traffic consumption by employees' computers will allow you to find the most active network users. When using WMI sensors, you do not even need to install anything on network computers, you only need an administrator password.

Unfortunately, in our country Internet traffic for legal entities cheap. It often happens that excessive Internet activity of users (often unrelated to the workflow) leads to overspending organizations to pay for the connection. Using our program will help prevent unexpectedly high Internet bills in the enterprise. you can customize notification for the consumption of a certain amount of traffic networked computers over a period of time.

You can observe graphs of the speed of incoming and outgoing traffic computers and network devices on the screen in real time. Can be promptly determine who spends the most traffic and kills the channel.

The program monitors the traffic consumption on network computers constantly and can notify you when certain conditions are met that you can set. For example, if the amount of traffic consumed by any computer exceeds a specified value, or the average information transfer rate for a certain period is above/below the threshold value. When a given condition is met, the program notify you in one of the following ways:

• displaying a message on a computer screen;
• sound signal;
• sending e-mail messages;
• writing to the program log file;
• entry in the Event Log of the system.

In addition, the traffic accounting program can execute certain actions when the conditions are met: run the program, execute a VB or JS script, restart the service, restart the computer, etc.

As the monitoring program works accumulates traffic consumption statistics network computers. You can at any time find out who and how much traffic consumed at any time, what data transfer rates were achieved. Traffic download/upload speed charts, as well as traffic consumption tables, can be built for any period of time or date.

Awards

In February 2015, the English version of the program earned the award - the finalist of the "Network Computing Awards 2015" competition of the popular British magazine "Network Computing" in the nomination "Product of the Year for IT Optimization" (IT Optimization Product of The Year).

When you purchase a license, you will receive a subscription to free software updates and technical updates. support for one year.

Download the free 30-day trial now and try it out! Windows XP/2003/Vista/2008/7/8.1/2012/10/2016 are supported.

Traffic consumption is primarily interested in users who are deprived of the opportunity to connect unlimited Internet. Traffic is controlled special programs or using Windows features.

Control over traffic consumption will help to avoid unnecessary expenses. Even if you use unlimited Internet, periodically check your network activity. A sharp increase in traffic consumption indicates that a virus or Trojan has settled in the system.

Many network administrators often face problems that network traffic analysis can help solve. And here we are faced with such a concept as a traffic analyzer. So what is it?

The term " NetFlow" refers to a Cisco protocol designed to collect information about traffic over IP and monitor network traffic. NetFlow has been adopted as the standard protocol for streaming technologies.

NetFlow software collects and analyzes flow data generated by routers and presents it in a user-friendly format.

Several other network equipment vendors have their own monitoring and data collection protocols. For example, Juniper, another highly respected network device vendor, calls its protocol " j-flow". HP and Fortinet use the term " s-Flow". Although the protocols are named differently, they all work in a similar way. In this article, we'll take a look at 10 free network traffic analyzers and NetFlow collectors for Windows.

SolarWinds Real-Time NetFlow Traffic Analyzer

This free tool is limited to one NetFlow monitoring interface and only saves 60 minutes of data. This Netflow Analyzer is a powerful tool that is well worth using.

Colasoft Capsa Free

Other features include network security analysis. For example, tracking DoS / DDoS attacks, worm activity and detection of ARP attacks. As well as packet decoding and information display, statistics about each host on the network, packet exchange control and stream reconstruction. Capsa Free supports all 32-bit and 64-bit versions of Windows XP.

Minimum system requirements for installation: 2 GB of RAM and a 2.8 GHz processor. You must also have an ethernet connection to the internet ( compatible with NDIS 3 or higher), Fast Ethernet, or Gigabit with a mixed mode driver. It allows you to passively capture all packets transmitted over an Ethernet cable.

Angry IP Scanner

ManageEngine NetFlow Analyzer Professional

The free version of the Linux traffic analyzer allows you to use the product indefinitely for 30 days, after which you can only monitor two interfaces. System requirements for NetFlow Analyzer ManageEngine depend on the flow rate. Recommended requirements for a minimum flow rate of 0 to 3000 threads per second: 2.4 GHz dual-core processor, 2 GB of RAM and 250 GB of free hard disk space. As the flow rate to be monitored increases, the requirements also increase.

The Dude

JDSU Network Analyzer Fast Ethernet

The application supports the creation of highly detailed graphs and tables that allow administrators to track traffic anomalies, filter data to sift through large amounts of data, and more. This tool for entry-level professionals, as well as for experienced administrators, allows you to completely take control of the network.

Plixer Scrutinizer

Wireshark

System requirements: Windows XP and higher, any modern 64/32-bit processor, 400 Mb of RAM and 300 Mb of free disk space. Wireshark NetFlow Analyzer is a powerful tool that can greatly simplify the work of any network administrator.

Paessler PRTG

The free version allows you to use an unlimited number of sensors for 30 days, after which you can only use up to 100 for free.

nProbe

nProbe supports IPv4 and IPv6, Cisco NetFlow v9 / IPFIX, NetFlow-Lite, VoIP traffic analysis, stream and packet sampling, logging, MySQL/Oracle and DNS activity, and much more. The application is free if you download and compile the traffic analyzer on Linux or Windows. The setup executable limits the amount of capture to 2000 packages. nProbe is completely free for educational institutions, as well as non-profit and scientific organizations. This tool will work on 64-bit versions of Linux and Windows operating systems.

This list of 10 free NetFlow traffic analyzers and collectors will help you get started monitoring and troubleshooting a small office network or a large multi-site corporate WAN.

Each application presented in this article makes it possible to monitor and analyze traffic on the network, detect minor failures, identify bandwidth anomalies that may indicate security threats. As well as visualize information about the network, traffic, and more. Network administrators should definitely have such tools in their arsenal.

This publication is a translation of the article " Top 10 Best Free Netflow Analyzers and Collectors for Windows» prepared by a friendly project team

Good bad

Any administrator sooner or later receives an instruction from the management: "calculate who goes to the network and how much he downloads." For providers, it is supplemented by the tasks of "letting anyone in, taking payment, restricting access." What to count? How? Where? There is a lot of fragmentary information, they are not structured. We will save the novice admin from tedious searches by providing him with general knowledge and useful links to the materiel.
In this article I will try to describe the principles of organizing the collection, accounting and control of traffic on the network. We will consider the issues of the issue, and list possible ways to retrieve information from network devices.

This is the first theoretical article in a series of articles dedicated to the collection, accounting, management and billing of traffic and IT resources.

Internet access structure

• External resources - the Internet, with all sites, servers, addresses and other things that do not belong to a network that you control.
• An access device is a router (hardware or PC-based), switch, VPN server or hub.
• Internal resources - a set of computers, subnets, subscribers, whose work in the network must be taken into account or controlled.
• Management or accounting server - a device that runs specialized software. It can be functionally combined with a software router.

Network traffic

To transmit an IP packet over wires (or radio), network devices are forced to “wrap” (encapsulate) it into a Layer 2 (L2) protocol packet. The most common protocol of this type is Ethernet. The actual transfer "to the wire" is at the 1st level. Usually, the access device (router) does not analyze packet headers at a level higher than 4th (an exception is intelligent firewalls).
Information from the fields of addresses, ports, protocols and length counters from the L3 and L4 headers of data packets make up the “source material” that is used in traffic accounting and management. The actual amount of information to be transferred is in the Length field of the IP header (including the length of the header itself). By the way, due to packet fragmentation due to the MTU mechanism, the total amount of data transmitted is always over size payload.

The total length of the IP and TCP/UDP fields of the packet that are of interest to us in this context is 2...10% of the total packet length. If you process and store all this information batch by batch, there will not be enough resources. Fortunately, the vast majority of traffic is structured in such a way that it consists of a set of "dialogues" between external and internal network devices, the so-called "flows". For example, within a single e-mail forwarding operation (SMTP protocol), a TCP session is opened between the client and the server. It is characterized by a constant set of parameters (Source IP address, Source TCP port, Destination IP address Destination TCP port). Instead of processing and storing information packet by packet, it is much more convenient to store flow parameters (addresses and ports), as well as additional information - the number and sum of lengths of transmitted packets in each direction, optionally session duration, router interface indices, ToS field value, and so on. This approach is beneficial for connection-oriented protocols (TCP), where it is possible to explicitly intercept the moment the session ends. However, even for non-session-oriented protocols, it is possible to aggregate and logically complete a stream record by, for example, a timeout. Below is an excerpt from the SQL database of our own billing system that logs information about traffic flows:

It should be noted the case when the access device performs address translation (NAT, masquerading) to organize access to the Internet for computers on the local network using a single, external, public IP address. In this case special mechanism performs substitution of IP addresses and TCP / UDP ports of traffic packets, replacing internal (not routable on the Internet) addresses according to its dynamic translation table. In this configuration, it must be remembered that in order to correctly record data on internal network hosts, statistics must be collected in a way and in the place where the translation result does not yet “anonymize” internal addresses.

Methods for collecting information about traffic / statistics

PC router

How to set up such a server, address translation and routing, much has been written. We are interested in the next logical step - information on how to obtain information about the traffic passing through such a server. There are three common ways:

• interception (copying) of packets passing through the server network card using the libpcap library
• interception of packets passing through the built-in firewall
• use of third-party tools for converting per-packet statistics (obtained by one of the two previous methods) into a stream of aggregated information netflow

libpcap

The operation of libpcap requires support from the operating system, which currently comes down to installing a single library. In this case, the application (user) program that collects packages must:

• open required interface
• specify the filter through which to pass received packets, the size of the captured part (snaplen), the size of the buffer,
• set the promisc parameter, which puts the network interface into capture mode for all packets passing by in general, and not just those addressed to the MAC address of this interface
• set a function (callback) to be called on each received packet.

When transmitting a packet through the selected interface, after passing the filter, this function receives a buffer containing Ethernet, (VLAN), IP, etc. headers, total size up to snaplen. Since the libcap library copies packages, it is not possible to block their passage with it. In this case, the traffic collection and processing program will have to use alternative methods, for example, calling a script to place the specified IP address in the traffic blocking rule.

Firewall

• A user program - a traffic handler registers itself in the system using a system call, or a library.
• The user program or an external script sets a rule in the firewall, "wrapping" the selected traffic (according to the rule) inside the handler.
• For each passing packet, the handler receives its contents in the form of a memory buffer (with IP headers, etc. After processing (accounting), the program must also tell the operating system kernel what to do next with such a packet - discard or pass it on. Alternatively, it is possible pass the modified packet to the kernel.

Since the IP packet is not copied, but sent to the analysis software, it becomes possible to "eject" it, and therefore, completely or partially limit traffic of a certain type (for example, to a selected local network subscriber). However, if the application stops responding to the kernel about its decision (hangs, for example), traffic through the server is simply blocked.
It should be noted that the described mechanisms, with significant amounts of transmitted traffic, create an excessive load on the server, which is associated with constant copying of data from the kernel to the user program. The method of collecting statistics at the level of the OS kernel does not have this drawback, with the issuance of aggregated statistics to the application program using the NetFlow protocol.

Netflow

The volume of information about traffic is several orders of magnitude smaller than the traffic itself, which is especially important in large and distributed networks. Of course, it is impossible to block the transfer of information when collecting statistics on netflow (if you do not use additional mechanisms).
Currently becoming popular further development of this protocol is version 9, based on the flow record template structure, an implementation for devices from other manufacturers (sFlow). Recently, the IPFIX standard has been adopted, which allows statistics to be transmitted over protocols of deeper levels (for example, by application type).
The implementation of netflow sources (agents, probes) is available for PC routers, both in the form of utilities working according to the mechanisms described above (flowprobe, softflowd), and directly built into the OS kernel (FreeBSD: , Linux: ). For software routers, the netflow statistics stream can be received and processed locally on the router itself, or sent over the network (transmission protocol - over UDP) to the receiving device (collector).


The collector program can collect information from many sources at once, being able to distinguish between their traffic even with overlapping address spaces. With the help of additional tools, such as nprobe, it is also possible to carry out additional data aggregation, stream bifurcation or protocol conversion, which is important when managing a large and distributed network with dozens of routers.

The netflow export functions support routers from Cisco Systems, Mikrotik, and some others. Similar functionality (with other export protocols) is supported by all major network equipment manufacturers.

libpcap "outside"

• Ethernet hub: A device that simply forwards packets between all of its ports indiscriminately. In modern realities, it can be found somewhere in a dusty warehouse, and this method is not recommended: unreliable, low speed (there are no hubs at a speed of 1 Gbps)
• Ethernet - a switch with the ability to mirror (mirroring, SPAN ports. Modern intelligent (and expensive) switches allow you to copy all traffic (incoming, outgoing, both) to the specified port of another physical interface, VLAN, including remote (RSPAN)
• Hardware splitter, which may require installation to collect two network cards instead of one - and this is in addition to the main, system one.

Naturally, you can configure the SPAN port on the access device itself (router), if it allows it - Cisco Catalyst 6500, Cisco ASA. Here is an example of such a configuration for a Cisco switch:
monitor session 1 source vlan 100 ! where do we get packages from
monitor session 1 destination interface Gi6/3! where do we ship packages?

SNMP

• traffic blocking can only be done by completely disabling the interface, using the same SNMP
• traffic counters taken via SNMP refer to the sum of the lengths of Ethernet packets (with unicast, broadcast and multicast separately), while the rest of the tools described earlier give values ​​relative to IP packets. This creates a noticeable discrepancy (especially on short packets) due to the overhead caused by the length of the Ethernet header (however, this can be approximately dealt with: L3_bytes = L2_bytes - L2_packets*38).

VPN

Conclusion

Let's sum up a little. In practice, there is a large number of methods of connecting a network you manage (with clients or office subscribers) to an external network infrastructure using a number of access tools - software and hardware routers, switches, VPN servers. However, in almost any case, you can come up with a scheme when information about the traffic transmitted over the network can be directed to a software or hardware tool for its analysis and management. It is also possible that this tool will allow feedback from the access device, applying intelligent access restriction algorithms for individual clients, protocols, and more.
This concludes the analysis of materiel. Of the unresolved topics remained:

• how and where the collected traffic data goes
• traffic accounting software
• what is the difference between billing and a simple “counter”
• how to limit traffic
• recording and limiting visited websites

These are programs that allow you to track active connections across all network interfaces.

Modern tools for detailed and detailed traffic monitoring, as a rule:

• are fairly affordable;
• allow you to limit the speed of each connection separately;
• give a clear picture of what files and programs load the network and what speed they need to have;
• allow you to determine the sources of the highest traffic consumption.

The program will help you determine your priorities when using the network.

Today, there are many similar utilities for monitoring and planning traffic consumption.

CommTraffic

This is a program for controlling Internet traffic both in the local network (it monitors the Internet activity of several clients at once) and on a personal computer using a modem connection. Accounting and statistics of work on the Internet will be displayed in the form of bandwidth graphs. They show the amount of outgoing, incoming and total traffic.

The program can be configured for almost any tariff plan, which is based on the set volume, takes into account the time of day and connection time. The CommTraffic utility is equipped with:

• convenient indication;
• accurate calculation of costs;
• the possibility of notification in case of overspending.

Besides, it is simple and convenient to use. Once you set a traffic and time limit that corresponds to your tariff plan, you will receive notifications with a sound signal or a message to the specified address when you approach the set limits.

Program for monitoring Internet traffic Network Meter

A network information collection application that allows you to monitor all network adapters installed in the system. It also provides detailed statistics about outgoing and incoming traffic. To get started, set up the downloaded program the first time you run it. To do this, specify what data you want to see in the main window, and the adapters that Network Meter will "monitor".

Minimize the utility window to the notification panel so that it does not take up space on the desktop. Even in this state, the application continues to work in the background.

The program will build graphs of the consumption intensity of the network connection in real time. It is not overloaded with unnecessary interface elements and settings. The graphical shell of the utility is clear and simple. You can also see with it:

• Internet session duration, MAC address and IP;
• connection type;
• cable throughput to the maximum.

By downloading Network Meter, you will get a fairly compact, simple and free tool. Great for monitoring traffic and viewing information about network equipment.

Internet traffic counter Simbad Traffic Counter

The utility keeps records of incoming and outgoing traffic, and also calculates, according to the tariff of your Internet provider, its cost. The display of consumed traffic is carried out in various values ​​(gigabytes, megabytes, kilobytes). In addition, the application keeps statistics. It will automatically detect the modem connection, display the time spent on the Internet. This program for monitoring Internet traffic practically does not consume system resources and has a small size. Supports work with a large number of protocols.

Net Activity Diagram Application

Net Activity Diagram, a program for monitoring traffic and Internet speed, monitors the Internet and network activity of a computer.

Produces:

• tracking all established connections;
• output of various warnings in the form of a message;
• traffic analysis for specified periods of time.

The current network activity is displayed both in a separate window and on the taskbar. In addition, the Net Activity Diagram service tracks statistics independently for each port and provides the ability to monitor each type of traffic separately.

The programs are quite flexible. It informs the user in cases of exceeding or approaching the established limits.

Traffic accounting using Internet Connection Counter

This Internet traffic control software will allow you to take into account the cost and time spent on the Internet, total consumed traffic. Supports different types connections: Dial-Up, ADSL, LAN, GPRS, etc.

With this utility, the user can:

• use several Internet provider tariffs at the same time;
• get acquainted with the statistics on the traffic used;
• tune appearance applications.

In addition, the application will show all active connections, synchronize the system clock and export a report to Excel format.

Traffic saving program

HandyCache will allow you to significantly (3-4 times) through caching. The next time you visit the site, the application will help you not to download it from the Internet. In addition, you can view these sites and without an Internet connection, offline.

To get started, you need to install HandyCache and specify it in your browser as a proxy server. After that, all browsers you have installed will use the HandyCache cache. The default settings of this application are suitable for users in most cases.

The utility is equipped with flexible settings to control a variety of parameters. Can load files from cache depending on HandyCache file type or URL. And if necessary, it will download files from the Internet in case of a constant version update. Before that, the program will check their version and only then make a decision about accessing the download source.

The utility is convenient in that to search for any previously used data, you do not need to find them again. Just look in the cache for a folder with the same name as the site name. In addition, this Internet traffic control program for Android is ideal.

Clear and accurate accounting of money

As well as time and traffic can be exercised using the application StatistXP. The program for monitoring Internet traffic will allow you to comfortably and economically use the network. 10 launches are given for the trial period. And for further use, the utility is equipped with the option of prepayment and Internet cards.

The program implements:

• notification when connected and disconnected by voice;
• accounting of time, money and traffic with connection statistics by months and years;
• there is detailed information.

BitMeter II - software for monitoring Internet traffic

This utility is a traffic counter. In addition, it is equipped a wide range tools for collecting and monitoring network connections.

In the main window of the application in real time, you can see a graph of outgoing and incoming traffic. To quickly calculate the time spent on downloading, there is a special calculator.

The application supports the installation of warnings about exceeding the limits of the maximum traffic limit and Internet connection time.

Some features of the program:

• Customizable settings and alerts when speed drops to established level or when loading a certain amount of data.
• Monitoring and recording of uploads and downloads. This will allow you to see how much traffic was used during a specific time period.
• Screen stopwatch.
• Good help file.
• Convenient customizable appearance.
• Ability to selectively monitor network cards.