0

We have approximately 25 Vmware boxes and we would like to install a tool on just one machine (our main machine) that could sniff the router and report usage possibly by IP address.

Ex:

Machine1 downloaded 2 GBs today
Machine 2 downloaded 100 GBs today

so we can know that machine2 has some suspicious activity going on.

Is there any tool available for it. Free tool works best but if small cost is involved we are fine with it.

2 Answers 2

1

There are different ways of handling this - normally this would be done by a router, but the simplest way to do something might be to set up SNMP on each of the VM servers and then use an SNMP graphing tool to provide information (for example Cacti, but there are plenty of others which may be more suitable).

0
0

Here are some other options. I do not work for any of these companies nor am I a paid spokesman of any products listed below, just wanted to make that clear. By all means, feel free to ask any questions regarding any of these products, I have a lot of experience using each application I have listed below.

The Dude

Price: Free

http://www.mikrotik.com/thedude

The Dude network monitor is a new application by MikroTik which can dramatically improve the way you manage your network environment. It will automatically scan all devices within specified subnets, draw and layout a map of your networks, monitor services of your devices and alert you in case some service has problems.

SpiceWorks Network Monitor

Price: Free

http://www.spiceworks.com/download/monitor/

Set up Spiceworks Network Monitor in just minutes to do real-time monitoring of your critical Windows and Linux servers. Spiceworks Network Monitor keeps an eye on server performance and uptime, so you’ll know when they’re sluggish, overwhelmed or crashed long before your users start calling. Just add your servers to your device list and start seeing data in seconds.

Labtech

Price: Depends on number of seats you want to monitor

http://www.labtechsoftware.com/

Allows remote control of large numbers of machines (Windows, Linux and Mac), scripting, health checks, SNMP queries, ticketing/alert system, remote control (via RDP, VNC, telnet, ssh, serial, modem) of nearly any type of device that has a connection to a network. Also has a lot of cool report generation functionality (for example, you can setup a job to have a daily/weekly/monthly system health check report sent to your email automatically). I am not even scratching the surface here, but if you need functionality past just checking if a connection is up or down and how much data it is transferring, I would go sign up for a 2 week demo and you will see what I mean. The only downside is the price, which may or may not be an issue depending on your environment.

Linux NST

Price: Free

http://www.networksecuritytoolkit.org/nst/index.html

If you are comfortable with Linux, I would look into a distribution called Linux NST (Network Security Toolkit). Network Security Toolkit (NST) is a bootable ISO image (Live DVD) based on Fedora 22 providing easy access to best-of-breed Open Source Network Security Applications and should run on most x86/x86_64 platforms.

The main intent of developing this toolkit was to provide the security professional and network administrator with a comprehensive set of Open Source Network Security Tools. The majority of tools published in the article: Top 125 Security Tools by INSECURE.ORG are available in the toolkit. An advanced Web User Interface (WUI) is provided for system/network administration, navigation, automation, network monitoring, host geolocation, network analysis and configuration of many network and security applications found within the NST distribution. In the virtual world, NST can be used as a network security analysis, validation and monitoring tool on enterprise virtual servers hosting virtual machines.

Not the answer you're looking for? Browse other questions tagged .