The True Price of Bandwidth Monitoring

By Art Reisman

Art Reisman CTO

For most IT administrators, bandwidth monitoring of some sort is an essential part of keeping track of, as well as justifying, network expenses. Without visibility into a network load, an administrator’s job would degrade into a quagmire of random guesswork. Or would it?

The traditional way of  looking at monitoring your Internet has two parts: the fixed cost of the monitoring tool used to identify traffic, and the labor associated with devising a remedy. In an ironic inverse correlation, we assert that costs increase with the complexity of the monitoring tool. Obviously, the more detailed the reporting tool, the more expensive its initial price tag. The kicker comes with part two. The more expensive the tool, the more  detail  it will provide, and the more time an administrator is likely to spend adjusting and mucking, looking for optimal performance.

But, is it a fair to assume higher labor costs with  more advanced monitoring and information?

Well, obviously it would not make sense to pay more for an advanced tool if there was no intention of doing anything with the detailed information it provides. Why have the reporting tool in the first place if the only output was to stare at reports and do nothing? Typically, the more information an admin has about a network, the more inclined he might be to spend time making adjustments.

On a similar note, an oversight often made with labor costs is the belief  that when  the work needed to adjust the network comes to fruition, the associated adjustments can remain statically in place. However, in reality, network traffic changes constantly, and thus the tuning so meticulously performed on Monday may be obsolete by Friday.

Does this mean that the overall productivity of using a bandwidth tool is a loss? Not at all. Bandwidth monitoring and network mucking can certainly result in a cost-effective solution. But, where is the tipping point? When does a monitoring solution create more costs than it saves?

A review of recent history reveals that technologies with a path similar to bandwidth monitoring have become commodities and shunned the overhead of most human intervention.  For example, computer operators disappeared off the face of the earth with the invention of cheaper computing in the late 1980’s.  The function of a computer operator did not disappear completely, it just got automated and rolled into the computer itself. The point is, anytime the cost of a resource is falling, the attention and costs used to manage it should be revisited.

An effective compromise with many of our customers is that they are stepping down from expensive complex reporting tools to a simpler approach. Instead of trying to determine every type of traffic on a network by type, time of day, etc., an admin can spot trouble by simply checking overall usage numbers once a week or so. With a basic bandwidth control solution in place (such as a NetEqualizer), the acute problems of a network locking up will go away, leaving what we would call only “chronic” problems, which may need to be addressed eventually, but do not require immediate action.

For example, with a simple reporting tool you can plot network usage by user.  Such a report, although limited in detail, will often reveal a very distinct bell curve of usage behavior. Most users will be near the mean, and then there are perhaps one or two percent of users that will be well above the mean. You don’t need a fancy tool to see what they are doing; abuse becomes obvious just looking at the usage (a simple report).

However, there is also the personal control factor, which often does not follow clear lines of ROI (return on investment).

What we have experienced when proposing a more hands-off model to network management is that a customer’s comfort depends on their bias for needing to know, which is an unquantifiable personal preference. Even in a world where bandwidth is free, it is still human nature to want to know specifically what bandwidth is being used for, with detailed information regarding the type of traffic. There is nothing wrong with this desire, but we wonder how strong it might be if the savings obtained from using simpler monitoring tools were converted into a trip to Hawaii.

In our next article, we’ll put some real world numbers to the test for actual break downs, so stay tuned. In the mean time, here are some other articles on bandwidth monitoring that we recommend. And, don’t forget to take our poll.

List of monitoring tools compiled by Stanford

Linux Tips
How to set up a monitor for free

Created by APconnections, the NetEqualizer is a plug-and-play bandwidth control and WAN/Internet optimization appliance that is flexible and scalable. When the network is congested, NetEqualizer’s unique “behavior shaping” technology dynamically and automatically gives priority to latency sensitive applications, such as VoIP and email. Click here for a full price list.

How to set up a computer for network monitoring – for free!

By Art Reisman, CTO,

Art Reisman CTO

Art Reisman

Editors note:

We often get asked where to find a simple network monitoring tool.  Well, you can get more economical than this!   All you need is some elbow grease and perseverance.  Note: We are not the original authors of this idea and have adopted it to our blog, unfortunately I was unable to trace back to the original to give credit.

How to set up a computer for network monitoring – All for free!

This is not as hard as it looks, once you have done it a time or two you can be up and running in less than 5 minutes, assuming you have high-speed access to the Internet.

Do you have a computer with the following?

  • 2 network cards installed or two on-board LAN ports
  • 1 CDRom drive
  • 256 to 1,024 or more Meg of RAM
  • monitor
  • keyboard
  • mouse (optional — it is necessary if you boot into the graphics mode, though)

If so, you can be minutes away from having a network monitoring machine up and running that you can insert in your network and see what is going on.  If you follow these instructions it will act as a transparent bridge so no other machines or routers will know the difference.

The Knoppix CD is a live CD distribution which does not need a floppy or hard drive to run. It is all self contained on the CD. It uses your RAM as a read/writeable area so you can still install a few programs if need be and edit most of the configuration files.

You can get the Knoppix iso image from or the English version at

The download page for English reading when this article was written is at

Download a CD image of 4.02 or better. A typical file name will be:


The filename ends in -EN and if you speak english then get that one. If you speak German, then get the -DE one.

Now burn that .iso file to a CD using your program of choice (burning the CD image to make a bootable CDRom is not covered here).

You should insert your machine into the network so it is between the Router and the switch, assuming you want to monitor traffic going from or to your network and the Internet. You may have to use a crossover cable from one of your machines LAN ports to the router and a standard network cable from the other LAN port on your machine and the switch.

Internet or Router or ???
| |
| | eth0
_____| |_______________________
|     Monitoring Unit                          |
eth1  ||
|     Internal Network Switch                |
|| || || || || || || || || || ||
Your internal network users or whatever you want to monitor

Once that is done you can run Knoppix by placing it into your machine and booting up. If you have a limited video card or an old monitor then you can hit the appropriate key when Knoppix boots up and find the option to boot into text mode only. You may also want to do this if you have limited RAM.

Once you are booted up and running Knoppix you can do the following:

If you booted to an XWindows look then click on the little computer screen icon next to the house on the bottom tool bar. If you booted into text mode you do not have to do that.

Now gain root access by typing the following and then Enter:


Now that you are root you can run the following commands to start up your transparent bridge and get traffic flowing through the machine from one lan port to the other. The IP below was use as an example along with the default gateway being so change those if your network is on a different IP range. You will want to give it an IP so that you can get into the machine from another machine on the network. In some cases you might want to be able to get to it from the Internet so in that case you would have to give it an IP that can be reached from the Internet and not a 10.x.x.x or 192.168.x.x number.

ifconfig br0 down
brctl delbr br0
ifconfig eth1 down
ifconfig eth0 down
ifconfig eth0 promisc up
ifconfig eth1 promisc up
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 netmask up
route add default gw

It may take a half a minute for traffic to start flowing through the transparent bridge br0.

Once you can do something like:


and it comes back with ping times then you are ready to continue. BTW: hit CTRL C to stop ping.

apt-get update
apt-get install ntop

Say Y or hit enter to install ntop. When it is all done do the following:

mkdir /var/log/ntop/rrd
chmod -R 777 /var/lib/ntop
chmod -R 777 /var/log/ntop

warning: the chmod commands above allow anyone to read/write to those directories that can get to the machine so keep your machine safe with firewalls or passwords accordingly.

You can now run ntop. You need to run ntop from the console or via SSH first by just running the command:


It will ask you for an admin password and then again to,verify it. This is for the admin interface in ntop.

Once ntop is up and running in  a window you can leave that up and just go to your web browser and put in the URL of:

The :3000 is the special port that the ntop web server runs on.

If you choose the menu item Summary and then Network Load you should see a graph of your traffic. Not all ntop menu items are used on every system. Most of the time you will only be using the items under Summary or All Protocols.

You now have a running bandwidth monitoring system. ntop is the only application mentioned here but there are others installed on the default Knoppix CD already too.

Related post

The systems I have installed this routine on vary from a system with a Celeron to one with a P4 CPU Running on 10/100 Realtek chipsets to 10/100/1000 Intel chipsets. From 256 Meg of RAM to 2 GIG. Knoppix runs very well on a variety of hardware but your mileage may differ.

Created by APconnections, the NetEqualizer is a plug-and-play bandwidth control and WAN/Internet optimization appliance that is flexible and scalable. When the network is congested, NetEqualizer’s unique “behavior shaping” technology dynamically and automatically gives priority to latency sensitive applications, such as VoIP and email. Click here for a full price list.

%d bloggers like this: