On Thu, Feb 09, 2006 at 07:16:09PM +0200, Marko Vukovic wrote:
> Zadikem, Travis wrote:
> >Just FYI.  I am wanting to monitor bandwidth and the sites that specific 
> >internal IP's are going to.
> 
> Consider then a Squid caching proxy server on your lan with Sarg doing 
> the reporting. See my posts in the archives about doing 
> intercept/transparent caching and forcing your users to browse via the 
> proxy.

I second this, although in my experience I have found Calamaris more
usable than Sarg, but that may be a matter of preference.

If you want to consider Internet usage beyond HTTP traffic, putting a
Linux or *BSD box inline with your traffic will open you to a wide range
of choices as to what to use: ntop gives great real-time information
but also cumulative statistics, ipfm gives simple but quite usable
per-client traffic figures too. Googling for "ip accounting" will
point you to a lot of packages, some of this stuff depends on
Netfilter (iptables) and will work only on Linux, some uses libpcap so
it will work on any modern Unix.

If you can export netflow data from a Cisco router (I think this can
be done from Unix boxes too, but I can't recall the name of the
package that does that) you'd have access to many tools, free and
non-free like Crannog Netflow Monitor (which gives very usable information
but isn't as stable and as accurate as it should).

Greets,
_Alain_