Monitoring Internet Usage: Free Lan Solutions

Monitoring internet usage in a local area network (LAN) is crucial for IT professionals to identify bottlenecks, understand the actual speed of the connection, and separate legitimate network usage from malicious activity. While there are many paid software solutions available, free tools can also be used to monitor network bandwidth.

One way to monitor internet usage is through your router or modem, which often have built-in tools that allow you to see how much data each device on your network is using. You can also use a third-party tool like GlassWire, which runs on your computer and monitors your internet usage in real-time. Another option is to use a packet sniffer like Wireshark, which can detect unusual or suspicious activity on your network. NetFlow and sFlow data from your routers and switches can also provide detailed information on who is sending and receiving data.

Other free tools for monitoring network bandwidth include SolarWinds Real-Time Bandwidth Monitor, BitMeter OS, FreeMeter Bandwidth Monitor, BandwidthD, and PRTG Bandwidth Monitor. These tools offer features such as real-time monitoring, alerts, and the ability to export data to CSV or other file formats.

Use a packet sniffer like Wireshark

Wireshark is a free, open-source packet sniffer and analysis tool that can be used to monitor internet usage in a LAN. It captures network traffic from ethernet, Bluetooth, wireless, token ring, and frame relay connections, among others, and stores that data for offline analysis.

Download and Install Wireshark:

Wireshark can be downloaded for free from the official website. It is available for Windows, Mac, and Linux. During the installation, make sure to install WinPcap (for Windows) or an equivalent packet capture driver for other operating systems. This is necessary to capture live network traffic.

Choose the Correct Network Interface:

Once Wireshark is installed, open the program. You will see a list of available network connections that you can monitor. Choose the network interface you want to capture packet data from. This could be Ethernet, Wi-Fi, or Bluetooth, depending on your setup.

Start Capturing Packets:

To start capturing packets, click on the network you want to monitor and press the "Start" button. You can also use the keyboard shortcut "Ctrl + E" or click on the blue shark fin button on the toolbar. Wireshark will now start capturing all packets on the selected network.

Apply Display Filters:

Wireshark allows you to filter the packet capture to focus on specific traffic. For example, you can set a filter to show only TCP traffic between two IP addresses or only packets sent from a particular computer. To apply a display filter, right-click on a packet and select "Conversation Filter" > "IP / TCP".

Analyze Captured Packets:

Wireshark provides three panes for inspecting packet data: the Packet List, Packet Details, and Packet Bytes. The Packet List shows all the captured packets with information such as time, source, destination, protocol, and length. The Packet Details pane provides readable information about the selected packet, and the Packet Bytes pane displays the internal data of the packet in hexadecimal format.

Measure Bandwidth Usage:

Wireshark has multiple ways to measure bandwidth usage. One common method is to use the "IO Graphs" function under the Statistics menu. This will plot your data and give you an idea of how much bandwidth is being used. You can customize the graph by changing the Y-axis to "Bits" to see the bandwidth usage in bits per second.

Find Bandwidth-Intensive Applications:

To find out which applications or clients are consuming the most bandwidth, go to the Statistics menu and click on "Endpoints". Sort the IP addresses by "Tx Bytes (Transmit)" to see which endpoint is using the most bandwidth.

View Network Statistics:

Wireshark provides a range of network statistics to help you understand your network traffic. From the Statistics menu, you can view the protocol hierarchy, conversations between endpoints, TCP packet retrieval times, VoIP calls, multicast streams, and more.

Advanced Features:

Wireshark also offers advanced features such as decryption of encrypted packets and creating custom protocol dissectors in Lua. Additionally, there are compatible network monitoring tools available, such as SolarWinds Network Performance Monitor, that can provide further insights into your network traffic.

Use NetFlow or sFlow data from routers and switches

NetFlow is a network monitoring protocol developed by Cisco to capture measurements about the volume and types of traffic traversing a network device. NetFlow data can be used to monitor incoming and outgoing traffic and to track which devices and end users are the top talkers on the network. NetFlow is a one-way technology, so when the server responds to the initial client request, the process works in reverse and creates a new flow record.

NetFlow solutions are made up of three primary tools: an exporter, a collector, and an analysis application.

NetFlow Exporter

When a client request is sent to a server, the device operating as an exporter tool reads the data packet headers and creates a flow record containing data about the IP addresses and ports the data is travelling to and from, the protocol number, and the size of the data and number of packets. This tool organises data packets into distinct flows and is responsible for sending flow records to a flow collector.

NetFlow Collector

This tool receives, stores and prepares the flow record data for analysis. Routers with the NetFlow feature enabled generate NetFlow records. These records are exported from the router and collected using a NetFlow collector. The NetFlow collector then processes the data, performs the traffic analysis, and presents the findings in a user-friendly format.

NetFlow Analysis Application

This tool analyses the flow record data to provide a better understanding of aggregate network traffic and performance. This can be used to assist with traffic profiling or intrusion detection efforts.

NetFlow Use Cases

• Network Management: NetFlow data can be used to monitor incoming and outgoing traffic and to track which devices and end users are the top talkers on the network.
• Quality of Service: NetFlow data can help admins ensure sufficient bandwidth is allocated for all service agreement levels.
• Scaling: NetFlow analysis can help identify under-provisioned resource pools and provide clear evidence of what needs to be prioritised as the company grows.
• Security: NetFlow tools can be used to spotlight anomalies in baseline network behaviour, providing admins with forensic evidence and tools to examine cybersecurity events in detail.
• Troubleshooting Issues: NetFlow data can be useful in determining exactly what devices or processes are causing bottlenecks.

Use built-in OS tools

If you are using Windows, you can use the built-in Windows Resource Monitor to monitor your network usage. This tool has grown quite advanced in what it shows under "network". You can also try the following steps to track your internet usage on the network:

• Press the Windows key + I keyboard shortcut to open the Settings app.
• Click Network & internet.
• Open the Usage details link to view network data usage for all your applications installed on your computer.

If you are using Linux, you can use the command-line tool `tcptrack` to monitor your network usage. This tool shows each live TCP connection with the source and destination IP address and how many kbps each one is using.

Use third-party software

If you're looking to monitor internet usage in a LAN for free, using third-party software is a great option. Here are some detailed instructions on how to do this:

Choose the Right Software:

• Identify your specific needs: Consider the size and complexity of your network, your budget, and the level of monitoring you want to achieve.
• Select a user-friendly option: Opt for software with a simple user interface that is easy to navigate and understand.
• Look for advanced features: Choose software that offers reporting, alerting, and analytical capabilities to help you make sense of the data.
• Ensure compatibility: Make sure the software is compatible with your operating system and hardware.
• Consider free options: There are free tools available, such as PRTG Network Monitor, Nagios, MRTG, and Cacti, that can provide basic monitoring capabilities.

Install and Set Up the Software:

• Follow the installation instructions provided by the software vendor.
• Configure the software to monitor all incoming and outgoing traffic on your network.
• Set up alerts and notifications to stay informed about any issues or unusual activity.
• Customize reports to suit your needs and help you identify trends and anomalies.

Monitor and Analyze:

• Use the software to gather data on bandwidth usage, traffic patterns, and network performance.
• Identify which devices, applications, or users are consuming the most bandwidth.
• Detect any bottlenecks, suspicious activity, or potential security threats.
• Utilize the software's analytical tools to gain insights and make informed decisions.

Take Action:

• Based on the insights gained from monitoring, implement policies to manage bandwidth usage more efficiently.
• Adjust settings or restrict access for specific devices or applications that are consuming excessive bandwidth.
• Stay proactive by regularly reviewing reports and alerts to spot potential issues before they become major problems.
• Optimize your network performance by addressing bottlenecks and improving resource allocation.

By following these steps and choosing the right third-party software, you can effectively monitor internet usage in your LAN without incurring additional costs. Remember to keep your software up to date and adjust your monitoring strategies as your network evolves.

Use a hardware device like a network tap or packet broker

A network tap or packet broker is a hardware device that can be used to monitor network traffic. These devices are placed in between the two endpoint devices and are connected directly to the cabling infrastructure. They allow you to access and monitor network traffic by copying packets without interrupting the flow of data. This means that the original data transmission is not affected, and the copied data can be used for monitoring and security analysis.

Network taps are simple devices that are generally placed in secured locations and can run for years without any issues. They are available in different types, such as passive taps, active taps, and virtual taps, each with its own unique features and capabilities. Passive taps, for example, are simple, reliable, and require no power, while active taps offer additional functionality like aggregation and regeneration.

When choosing a network tap, it is important to consider the quality, testing, hardware warranties, and Mean Time Between Failure (MTBF) rates. Additionally, proper cabling is crucial to ensure the tap functions correctly.

By using a network tap or packet broker, organizations can gain valuable insights into their network traffic and identify any issues or bottlenecks that may be causing problems. This information can then be used to optimize the network and improve its performance.

Frequently asked questions