[Snort-users] tracking usage by IP

Ing. Daniel Manrique roadmr at ...5706...
Fri Sep 6 08:52:06 EDT 2002


> Anyone know if it is possible to track usage using SNORT?  I need to track
> bandwidth usage by IP address.  For example:  Our office has let's say 100
> users, and someone is using up all the bandwidth downloading
> porn/movies/mp3s.  I would like to use SNORT to track down who is do that.

IMHO, snort is the wrong tool for this particular job. Take a look at
traffic analysis tools. For me, ntop and iptraf have been a great
combination to track down bandwidth hogs and pinpoint other bandwidth and
network-related issues.  Be aware that ntop in particular is quite
resource-intensive.

http://www.ntop.org
http://cebu.mozcom.com/riker/iptraf/





More information about the Snort-users mailing list