Persistent network traffic monitoring

I've recently had to switch from wired network to a USB dongle for my internet connection, and as the prepaid connection has a 2 GB limit, I'd like to record how much I'm using and get a warning when I'm running low. I'm already using Conky as a system monitor, and have it display the connection speed and the amount downloaded/uploaded, but as this is reset on reboot, I lose track of the total downloads I've had over a given period.
Is there a way to get conky to display the total transfer, so that it persists between connections? Or better yet, what's a way of recording the total transfer on different interfaces that's persistent between reboots?

The software I've used (on Windows btw) displayed the those stats, which I guess came from the ISP. So take a dive into the documentation of out whatever software you're using.
Edit:
Looking closer at the link in the previous post I withdraw earlier suggestions (on scripting a custom cronjob).
Last edited by Pingwinski (2011-01-11 05:07:10)

Similar Messages

[Request] NTM - Network Traffic Monitor

Hi to everyone:
Could anyone package this?: NTM - Network Traffic Monitor
NTM is a monitor of the network and internet traffic for GNU/Linux. Some characteristics:
* Choice of the interface to monitoring.
* Period to monitoring: Day, Week, Month, Year or Custom Days. With autoupdate.
* Threshold: Autodisconnection if a limit is reached (by NetworkManager).
* Traffic Monitoring: Inbound, outbount and total traffic; Show the traffic speed.
* Time Monitoring: Total time of connections in the period.
* Time Slot Monitoring: Number of sessions used.
* Reports: Show of average values and daily traffic of a configurable period.
* Online checking with NetworkManager or by "Ping Mode".
* The traffic is attributed to the day when the session began.
* Not need root privilege.
* Not invasive, use a system try icon.
NTM is useful for the people that have a internet plan with a limit, and moreover the exceed traffic is expensive.
NTM is write in python and is a open source software, the license is the GNU GPL v2.
A lot of thanks.

#Maintairner: Brieuc Roblin <brieuc.roblin at gmail dot com>
pkgname='ntm'
pkgver='1.2.2'
pkgrel='1'
pkgdesc="Monitor of the network and internet traffic"
arch=('i686' 'x86_64')
license=('GPL')
depends=('pywebkitgtk' 'lsb-release' 'networkmanager')
makedepends=('dpkg')
url=('http://netramon.sourceforge.net/eng/index.html')
source=('http://freefr.dl.sourceforge.net/project/netramon/NTM/ntm-1.x/ntm-1.2.2.deb')
md5sums=('ec438b8c952ac866ffdaa57538d189b7')
build() {
cd "$srcdir"
# Extracting deb
msg2 "Extracting .deb ..."
dpkg-deb -x ntm-*.deb deb
cd "deb"
# Installing
msg2 "Installing..."
cp -r . "$pkgdir"/
I can't really test the program as I'm not using NetworkManager.
Last edited by PyrO_70 (2010-08-20 19:18:24)

24 Hr Network Traffic Monitoring

Hi Markus,
I got this 24-hour Network traffic monitoring output using the program you gave me ;)
I run every hour this > ./network-traffic.sh -c 1
It will give me 1 line output like this,
Monitoring eth0 every 3 seconds. (RXbyte total = 1 Gb TXbytes total = 2 Gb)
RXbytes = 58 Kb TXbytes = 51 Kband I call this program every hour via cron, to produce and output like this:
27-Oct-2010 00:00:07    RXbytes = 10 Kb TXbytes = 9 Kb
27-Oct-2010 01:00:07    RXbytes = 11 Kb TXbytes = 9 Kb
27-Oct-2010 02:00:07    RXbytes = 7 Kb TXbytes = 6 Kb
27-Oct-2010 03:00:07    RXbytes = 48 Kb TXbytes = 42 Kb
27-Oct-2010 04:00:07    RXbytes = 448 b TXbytes = 0 b
27-Oct-2010 05:00:08    RXbytes = 128 b TXbytes = 0 b
27-Oct-2010 06:00:07    RXbytes = 128 b TXbytes = 0 b
27-Oct-2010 07:00:08    RXbytes = 256 b TXbytes = 0 b
27-Oct-2010 08:00:08    RXbytes = 14 Kb TXbytes = 24 Kb
27-Oct-2010 09:00:07    RXbytes = 11 Kb TXbytes = 10 Kb
27-Oct-2010 10:00:08    RXbytes = 11 Kb TXbytes = 10 Kb
27-Oct-2010 11:00:07    RXbytes = 48 Kb TXbytes = 85 Kb
27-Oct-2010 12:00:08    RXbytes = 9 Kb TXbytes = 8 Kb
27-Oct-2010 13:00:07    RXbytes = 13 Kb TXbytes = 28 Kb
27-Oct-2010 14:00:08    RXbytes = 53 Kb TXbytes = 46 Kb
27-Oct-2010 15:00:08    RXbytes = 13 Kb TXbytes = 20 Kb
27-Oct-2010 16:00:08    RXbytes = 13 Kb TXbytes = 20 Kb
27-Oct-2010 17:00:08    RXbytes = 40 Kb TXbytes = 94 Kb
27-Oct-2010 18:00:07    RXbytes = 13 Kb TXbytes = 30 Kb
27-Oct-2010 19:00:08    RXbytes = 6 Kb TXbytes = 9 Kb
27-Oct-2010 20:00:08    RXbytes = 12 Kb TXbytes = 12 Kb
27-Oct-2010 21:00:08    RXbytes = 15 Kb TXbytes = 40 Kb
27-Oct-2010 22:00:07    RXbytes = 9 Kb TXbytes = 11 Kb
27-Oct-2010 23:00:07    RXbytes = 11 Kb TXbytes = 9 KbIs this output data gathering style valid?
I want to give this report to my boss using spreadsheets, but I want to put comments like :
1. at what hour is the network busiest?
2. at what hour is the network the not-busiest?
How do I sort this output from busiest (descending order)?
Thanks a lot,
Ms K

Hi again markie,
This is my actual source code of eth0stat.sh:
# File: eth0stat.sh
# Purpose: Gather network traffic increase between readings
# Command: . ./eth0stat.sh
ifcmd='/sbin/ifconfig eth0'
timestamp=$(date "+%D %T")
logfile=/u01/Monitor/eth0stat.txt
old_rxbytes=$RXBYTES
old_txbytes=$TXBYTES
get_rxbytes() {
   $ifcmd | grep "RX bytes" | cut -d: -f2 | awk '{ print $1 }'
get_txbytes() {
   $ifcmd | grep "TX bytes" | cut -d: -f3 | awk '{ print $1 }'
RXBYTES=$(get_rxbytes); export RXBYTES
TXBYTES=$(get_txbytes); export TXBYTES
if [ $old_rxbytes > 0 ]; then
   diff_rxbytes=$(($RXBYTES - $old_rxbytes))
else
   diff_rxbytes=0
fi
if [ $old_txbytes > 0 ]; then
   diff_txbytes=$(($TXBYTES - $old_txbytes))
else
   diff_txbytes=0
fi
echo "$timestamp,RXbytes:$diff_rxbytes,TXbytes:$diff_txbytes" >> $logfileI created the new program you gave me (eth0stat.sh) and called it from cron every our, but I got this result:
11/01/10 15:00:07,RXbytes:0,TXbytes:0
11/01/10 16:00:07,RXbytes:0,TXbytes:0
11/01/10 17:00:07,RXbytes:0,TXbytes:0
11/01/10 18:00:07,RXbytes:0,TXbytes:0
11/01/10 19:00:07,RXbytes:0,TXbytes:0
11/01/10 20:00:07,RXbytes:0,TXbytes:0
11/01/10 21:00:07,RXbytes:0,TXbytes:0
11/01/10 22:00:08,RXbytes:0,TXbytes:0
11/01/10 23:00:07,RXbytes:0,TXbytes:0
11/02/10 00:00:07,RXbytes:0,TXbytes:0
11/02/10 01:00:08,RXbytes:0,TXbytes:0
11/02/10 02:00:08,RXbytes:0,TXbytes:0
11/02/10 03:00:07,RXbytes:0,TXbytes:0
11/02/10 04:00:07,RXbytes:0,TXbytes:0
11/02/10 05:00:07,RXbytes:0,TXbytes:0
11/02/10 06:00:08,RXbytes:0,TXbytes:0
11/02/10 07:00:08,RXbytes:0,TXbytes:0
11/02/10 08:00:07,RXbytes:0,TXbytes:0
11/02/10 09:00:08,RXbytes:0,TXbytes:0
11/02/10 10:00:08,RXbytes:0,TXbytes:0The output has all 0 bytes :( . Is there something I missed out?
I compared it to the other one I got:
1-Nov-2010 15:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 16:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 17:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 18:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 19:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 20:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 21:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 22:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
1-Nov-2010 23:00:07     RXbytes = 11 Kb TXbytes = 9 Kb
2-Nov-2010 00:00:07     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 01:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 02:00:08     RXbytes = 10 Kb TXbytes = 9 Kb
2-Nov-2010 03:00:07     RXbytes = 7 Kb TXbytes = 6 Kb
2-Nov-2010 04:00:07     RXbytes = 256 b TXbytes = 0 b
2-Nov-2010 05:00:07     RXbytes = 320 b TXbytes = 0 b
2-Nov-2010 06:00:08     RXbytes = 0 b TXbytes = 0 b
2-Nov-2010 07:00:08     RXbytes = 466 b TXbytes = 0 b
2-Nov-2010 08:00:07     RXbytes = 1 Mb TXbytes = 19 Mb
2-Nov-2010 09:00:08     RXbytes = 1 Mb TXbytes = 22 Mb
2-Nov-2010 10:00:08     RXbytes = 12 Kb TXbytes = 91 KbThe is seem to be movement starting at 8am Nov 2, 2010.
Please help me debug the eth0stat.sh.
Thanks again so much

Network traffic monitor

Hi! I bought a WRT310N wireless router a few weeks ago and I must say I am pretty satisfied with it.
However, I've been looking for something to monitor the traffic on my local network. The easylink advisor just shows me who is connected. Is there a more advanced software that makes me monitor more exactly the traffic from each connected computer?
Thanks for the help!
//Chris

No. Not with these cheap routers. There is no way to monitor the traffic going through the router nor the LAN traffic going through the switch.

E1000 network traffic monitoring

Hi
I recently purchased linksys e1000
Just wondering whether there is a way to automatically monitor traffic per computer connection on that router.
The router log does not show much.
I tried Wall Watcher, but it cannot connect to this router.
WireShark on a computer connected through a wire also doesn't show much.
I would appreciate any help as my ISP caps network usage
Thanks
Eugene

It might be true
However I know that the router logs conversations(or network transactions) per computer.
The log doesn't show indeed how much traffic was used per conversation.
I don't know whether it is because the router does not log that info or because the access interface simply doesn't show that.
I also have a question whether there is a way for external application (such as Wall Watcher) to get access to the router log.
It would've been much easier for me to collect and analyze data

Networkled - system tray network traffic monitor

Hello,
Networkled is a small system tray utility which shows the flow of traffic on a network interface. It is written in C++ and Qt4. It shows the flow by blinking LEDs. It can also be put in startup of WMs, for example, load it after loading tint2 or pypanel on openbox by adding it to openbox's autostart.sh. I've also added a PKGBUILD to the aur by the name "networkled-git" since its hosted on github.com
http://aur.archlinux.org/packages.php?ID=36560
Hope you guys like it and also give your opinions and suggestions if you think some essential features are missing and should be there .
Thanks.

Seems to be nice, however how is this different from KNemo?
http://kde-apps.org/content/show.php?content=12956
The only difference i noticed is that it depends only on qt4, while KNemo depends on qt4 and kdelibs.

Best network traffic monitoring system??

We had tested so far Scrutinizer, Netflow Analyzer 6 and Orion with Netflow module from Solarwinds.
We like Netflow Analyzer but is a bit expensive. Scrutinizer does a great job too.
Just wondering what your thoughts are for these products or if there is any better one on the market.
We need to take a dessition soon and make the purchase.
Thank you,
Zeek

We currently use NFA and like it, but their Technical Support is horrible. They rarely respond to trouble tickets or take months between responses. Solarwinds makes great products, we use Orion and Cirrus. I don't like their Netflow product but it's something new for them and I'm sure it will get better with time. I have heard good things about Scrutinizer, but I have never used it. I recently eval'ed Flukes Netflow product [http://www.flukenetworks.com/fnet/en-us/promotions/it/NetFlow+Tracker+7+Day+Trial+Software+-+GoogleNetFlow.htm] and I really liked it. Fluke bought Crannog BTW, so it's that product.
HTH

Network Traffic Part 2

Hi Joe,
I am monitorring again the network traffic output of my rhel4 server, using the script you gave me,
and I got the following:
11/04/10 00:00:07,RXbytes:761952,TXbytes:427484
11/04/10 01:00:07,RXbytes:1253865,TXbytes:903771
11/04/10 02:00:07,RXbytes:561288,TXbytes:126774
11/04/10 03:00:08,RXbytes:614364,TXbytes:327579
11/04/10 04:00:08,RXbytes:626030,TXbytes:581122
11/04/10 05:00:08,RXbytes:448505,TXbytes:3935
11/04/10 06:00:07,RXbytes:363288,TXbytes:256
11/04/10 07:00:08,RXbytes:418344,TXbytes:512
11/04/10 08:00:07,RXbytes:3075147,TXbytes:20871024
11/04/10 09:00:08,RXbytes:21268121,TXbytes:96990878
11/04/10 10:00:07,RXbytes:28459877,TXbytes:311859635
11/04/10 11:00:08,RXbytes:7230007,TXbytes:37973840
11/04/10 12:00:08,RXbytes:6117714,TXbytes:41316205
11/04/10 13:00:08,RXbytes:9299506,TXbytes:59563899
11/04/10 14:00:07,RXbytes:12474670,TXbytes:46555827
11/04/10 15:00:08,RXbytes:12471005,TXbytes:129434535
11/04/10 16:00:08,RXbytes:7906737,TXbytes:64104023
11/04/10 17:00:08,RXbytes:29303369,TXbytes:145990135
11/04/10 18:00:08,RXbytes:14466168,TXbytes:44081112
11/04/10 19:00:07,RXbytes:16192064,TXbytes:52467858
11/04/10 20:00:08,RXbytes:1668065122,TXbytes:1358371970
11/04/10 21:00:08,RXbytes:1232966,TXbytes:685626
11/04/10 22:00:07,RXbytes:982910,TXbytes:477852
11/04/10 23:00:07,RXbytes:761526,TXbytes:218669
11/05/10 00:00:07,RXbytes:809886,TXbytes:982614
11/05/10 01:00:08,RXbytes:642301,TXbytes:126982
11/05/10 02:00:07,RXbytes:635841,TXbytes:218607
11/05/10 03:00:07,RXbytes:740963,TXbytes:1008036
11/05/10 04:00:07,RXbytes:624231,TXbytes:394317
11/05/10 05:00:08,RXbytes:448494,TXbytes:3653
11/05/10 06:00:08,RXbytes:415485,TXbytes:640
11/05/10 07:00:07,RXbytes:389860,TXbytes:512
11/05/10 08:00:07,RXbytes:26640050,TXbytes:353528988
11/05/10 09:00:07,RXbytes:17023417,TXbytes:209170566
11/05/10 10:00:07,RXbytes:48096899,TXbytes:592254609
11/05/10 11:00:07,RXbytes:29606627,TXbytes:-4094024665
11/05/10 12:00:07,RXbytes:14057405,TXbytes:94579667
11/05/10 13:00:07,RXbytes:11446821,TXbytes:42764768I still got negative at 11am todate, I know I didnot edit the program ne more :(
Don;t you think it is the peak ( highest period)?
Thanks a lot

Hi Dude :)
I did not know the "sar" has also network traffic monitoring, until you gave me the docs link which is:
http://www.linux-tutorial.info/modules.php?name=News&file=article&sid=3230
I got this network traffic statistics from the "sar" default monitoring system.
23:00:01        IFACE   rxpck/s   txpck/s   rxbyt/s   txbyt/s   rxcmp/s   txcmp/s rxmcst/s
23:10:01           lo     68.40     68.40 14143.49 14143.49      0.00      0.00      0.00
23:10:01         eth0      3.86      1.90    528.59    363.05      0.00      0.00      0.00
23:10:01         eth1      0.27      0.03     22.40      2.09      0.00      0.00      0.00
23:10:01         eth2      0.25      0.00     21.17      0.39      0.00      0.00      0.00
23:10:01         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
23:20:01           lo     62.71     62.71 11910.61 11910.61      0.00      0.00      0.00
23:20:01         eth0      2.70      0.64    292.53    134.17      0.00      0.00      0.00
23:20:01         eth1      0.27      0.03     22.85      2.00      0.00      0.00      0.00
23:20:01         eth2      0.25      0.00     21.30      0.39      0.00      0.00      0.00
23:20:01         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
23:30:01           lo     66.57     66.57 13785.36 13785.36      0.00      0.00      0.00
23:30:01         eth0      1.97      0.24    168.32     35.51      0.00      0.00      0.00
23:30:01         eth1      0.50      0.06     36.43      3.99      0.00      0.00      0.00
23:30:01         eth2      0.43      0.00     32.03      0.39      0.00      0.00      0.00
23:30:01         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
23:40:01           lo     67.49     67.49 14342.50 14342.50      0.00      0.00      0.00
23:40:01         eth0      1.81      0.24    155.01     35.56      0.00      0.00      0.00
23:40:01         eth1      0.26      0.02     21.75      1.49      0.00      0.00      0.00
23:40:01         eth2      0.23      0.00     20.00      0.39      0.00      0.00      0.00
23:40:01         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
23:50:01           lo     68.37     68.37 13966.97 13966.97      0.00      0.00      0.00
23:50:01         eth0      1.73      0.24    161.67     35.50      0.00      0.00      0.00
23:50:01         eth1      0.38      0.03     29.16      1.99      0.00      0.00      0.00
23:50:01         eth2      0.34      0.00     26.79      0.39      0.00      0.00      0.00
23:50:01         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:           lo    147.36    147.36 13546.40 13546.40      0.00      0.00      0.00
Average:         eth0     15.85     14.84   1627.46 10663.56      0.00      0.00      0.00
Average:         eth1      1.73      1.65    144.72   1133.77      0.00      0.00      0.00
Average:         eth2      0.32      0.00     25.54      0.39      0.00      0.00      0.00
Average:         sit0      0.00      0.00      0.00      0.00      0.00      0.00      0.00Do you think its the similar with the eh0stat.sh you gave me? do you think I have to use this one instead? or do you think this one is more accurate? :)
What does "lo" mean?
23:00:01        IFACE   rxpck/s   txpck/s   rxbyt/s   txbyt/s   rxcmp/s   txcmp/s rxmcst/s
Average:           lo    147.36    147.36 13546.40 13546.40      0.00      0.00      0.00Thanks

Unknown network traffic / router traffic monitoring

So I got a new PC with windows 7 on it, and I installed this gadget that monitors network traffic, and it shows a lot of traffic that my local PC isn't showing, so I am thinking there is something running on the LAN that I can't see. I was looking to find a live, better program to monitor the actiontec router, for traffic. anyone know of anything that can maybe show me who is using all the bandwidth on my network?
i have found software for Linksys, but nothing for the Actiontec.
Thanks,
Quasimodem
Fios in Florida
Solved!
Go to Solution.

Keep in mind that when looking at Wireshark (sniffer) software there are different types of traffic:
Unicast
Broadcast
Multicast
Unicast is traffic between two devices. You will see the traffic between the PC with wireshark and another device on your local network such as a printer, another PC or the Router. You should not see traffic between another PC and the Internet for example. Using a phone as an example some calls you and the conversation is between you and the person on the other end of the phone. This is unicast traffic. Using defaults of the actiontec, IP address seen will be 192.168.1.1 for the router and 192.168.1.2-99 for devices on your network. If you have the TV service, 192.168.1.100-1xx is used for the cable boxes.
Broadcast traffic is traffic sent to all devices. Its not directed toward a particular PC but rather usually looking for information. In a sniffer trace you will see broadcast traffic. Going back to the phone example, someone makes an announcement on an overhead intercom system that is broadcast traffic. Broadcast traffic will be seen as 192.168.255.255
Multicast traffic is traffic from one device for many devices. Usually used in video feeds. Using the phone system as an example someone wishes to tell a group of people something so instead of calling each person up and telling them each person who wants the information joins a conference bridge. Anyone is allowed to listen but only those that wish to get the information receive it. Generally how multicast works. Multicast traffic will be seen as IP address 224.x.x.x or something of the sorts where the address will be 2xx.x.x.x.
I hope this makes sense. Probably more information than you needed but at least it will help you understand what wireshark is telling you.

Weird - Activity Monitor Network Traffic vs iStat Traffic

With no applications running on my MacBook Pro, the Network tab of the Activity monitor is showing 'Data received/sec" toggling every second or so between 1.38 KB/s and 2.75 KB/s. It's showing the same numbers for 'Data sent/sec' as well. I can't figure out what is causing this network traffic. But if it's real, it's adding up to about 5 GB a month of bandwidth usage. My cap is only 60 GB so it's significant.
But when I use iStat or the Net Monitor app to monitor throughput, they show 0.0 traffic when the system is idle. Also, since last night Activity Monitor shows 322 MB data received and 99 MB data sent. While iStat shows 239 MB received and 16 MB sent.
So which is correct? Does Activity Monitor also include traffic that is internal to my network? Or do I have a phantom bandwidth hog somewhere?
Thanks for any insight to the weirdness.
Jim

The switches at home and at work generally corroborate the activity shown by tcpdump / atMonitor / MenuMeters, not the continuous data flow shown by Activity Monitor. The MacBook Air I'm sitting at right now shows similar discrepancies, with traffic totals in Activity Monitor about 40x higher than those shown with the other tools and a steady and inexplicable (and by other means invisible) 29-34 KB/sec of both sent & received traffic. tcpdump shows periods of network silence between 2-15 seconds in length (in between DNS lookups; netbios syncs; ntp queries; ipp messages; http, pop, and imap messages; etc. happening in bursts as one would expect).
Changing Activity Monitor to refresh every half second shows the mystery traffic as a burst of 112 KB sent & received every two seconds--and no, that's not the same throughput as the 29-34 KB seen at 2-second refresh intervals. When I set refresh to every 5 seconds, the mystery throughput drops to 22 KB / sec. As the throughput varies depending on refresh interval, I wonder if I'm seeing internal loopback queries (or something of that sort) contributing to the totals. Is it possible that the mystery traffic is of AM's own creation, and only exists within the machine and is not actually sent on the network?
Lest we digress further into general network troubleshooting techniques, let me restate the question, perhaps a bit more clearly: has anyone else seen this traffic-volume discrepancy between the Activity Monitor's Network tab and other network monitoring tools, and does anyone have an explanation for it?

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Can I use a real router and still have the Time Capsule for backups etc?
Yes, that is what Bridge Mode is for. Just connect the Time Capsule to a LAN <--> Ethernet port on your "main" router.

Monitoring network traffic from large queries to client

Hi, is there any way to monitor the volume from network traffic from the server to the client, the statistics SQL*net message to client and SQL*net message from client don't show a full picture.
I have a query that sends several GB of data to a client but the SQL*net statistics done show anything like this, is there any way I can see the volume of traffic from the RDBMS statistics?
Regards.

Alan Wilson wrote:
Hi, is there any way to monitor the volume from network traffic from the server to the client, the statistics SQL*net message to client and SQL*net message from client don't show a full picture.
I have a query that sends several GB of data to a client but the SQL*net statistics done show anything like this, is there any way I can see the volume of traffic from the RDBMS statistics?
Sounds like you're looking at the Wait events only - you need to check the instance (or session) activity - v$sysstat/v$sesstat for the following stats:
NAME
bytes sent via SQL*Net to client
bytes received via SQL*Net from client
SQL*Net roundtrips to/from clientIt's worth pointing out, by the way, that SQL*Net can do "compression" on the fly by comparing columns across rows of data sent, so the volumes you see in these stats may not match the volume you finally see arriing in the client code. ( http://jonathanlewis.wordpress.com/2010/05/07/sqlnet-compression/ )
If you need to optimise the transfer rate, look at the SQL*Net configuration (at both ends) for the Session Data Unit (SDU) and the o/s transmit and receive buffers.
Regards
Jonathan Lewis

Network traffic of an End-User Experience Monitoring (EEM) Robot

Dear Experts,
our company is currently using three EEM-Robots in different countries.
After one month we noticed, that the network traffic of the robots is quite high (one robot used about 8 GB in one month).
So I checked the configuration of the robots:
Every Robot runs about five scripts, which are executed every ten minutes. Therefore every robot exectues 30 scripts in one hour.
There are four SAPGUI Scripts and one http-script. Every Script (besides the http-Script) is collecting the system data (bold letters in the monitoring) and the trace level low (parameter trace.e2etracelevel = 0).
So I start measuring the network traffic. I observed the connection with Wireshark:
The robot uses in average 4000 Byte per second, which equates to 9,66 GByte for one month.
After stopping every script and rebooting the robot, I measured the traffic again.
The robot uses without executing a script in average 820 Byte per second, which equates to 2 GByte for one month.
Are there some settings I overlooked, possibilities to decrease the network traffic?
Is that size of network traffic within the normal range?
Regards
Alex
Edited by: Alexander Beck on Jan 11, 2012 10:57 AM

Hi Beck,
I am also working on End user experience monitoring.
I want to in depth details in End User Experience Monitoring. If you have screen shots please share for me.
Regards
Balaji
Edited by: Balaji Rao Bhoomraogari on Jan 18, 2012 12:19 PM

L4 Traffic Monitor question

In the IronPort web security appliance documentation, it indicates that the L4 traffic monitor ports (T1 and/or T2) should be connected to either a network tap or switch span.
I'm a little confused as to how this is supposed to be set up.
Does it mean that you take 2 ports on a switch, one on the same subnet/vlan as the P1 interface (data) on the IronPort, and the other that is on the subnet/vlan as the firwall (outbound Internet traffic) and create 2 monitor sessions (spans)? If so, where are these sessions pointed to?
Isn't the IronPort supposed to be doing the tapping/inspection?
The whole external tap thing has me confused.

Colin,
One way to think of it is that the WSA has 2 inspection engines that don't actually talk to one another...
1. the web proxy, where you're using WCCP to send specific traffic to
2. the L4TM engine that you send a spanned port to to catch all of the other weird stuff.
The web proxy does all of the user tracking/policy stuff, etc. Watching a specific set of ports.
The L4TM is intended for malware that might be running on your net... sort of like the Botnet Traffic filter that's available on ASA.
That said, you'll use 1 port for P1 on whatever vlan, redirection to that happens via WCCP or explicit proxy.
For the L4TM tap you can use 1 or 2 ports on the swtich, or none if you use an external tap. In the Network/Interfaces page, you set whether you want L4TM to use simplex or Duplex. If you use Duplex, just do a span session off the port the firewall is plugged into to the port that you connect T1 into...
If you use Simplex, you do 2 span sessions off of the port the firewall is connected to... ingress traffic on the port (eg. out of the firewall) to the port T1 is connected to, egress traffic on the port (eg. going to the firewall) spanned to the port T2 is hooked up to.
If you use an external tap, put it inline between the firewall and the switch, set the WSA for duplex and connect the "monitor" port to T1...
Hope that helps!
Ken

Can an Ironport work in both WCCPv2 and L4 Traffic monitoring modes at the same time?

Hello Ciscoers,
We have an ironport installed and we use WCCPv2 to redirect the traffic. And as it occurs, I have a need to forward the traffic for another network, that uses another path to the Internet.
So I was thinking using the L4 Traffic Monitoring.
To the best of your knowledge, is there a way to have the appliance use both WCCPv2 and L4 Traffic monitoring at the same time? From the configuration, it's one or the other.
Thanks,
J.

Ok. I'll try.
As a matter of fact, I plan to use policy-based routing to forward all the "interesting" traffic to the appliance.
For your TCP-Resets not seen, do you allow ingress on the span session?
J.

Persistent network traffic monitoring

Similar Messages

Maybe you are looking for