Hi all,

Is there some code somewhere (library/script) that I can look at
that will with the following:

I would like to monitor *all* traffic along the lines of
http://www.bwmonitor.com/ on whatever network(s) is/are active at the
time. Wireless and/or Ethernet.

Is there a way to monitor traffic in general moving across say wlan0
rather than specific protocols/ports (HTTP, FTP, etc)?

A Ruby solution would be good but Java/Python/Perl/ would be OK as well.

(The pipe dream was that I was going to try to write something like this
in all the languages above as a way to evaluate each of them).

(The even bigger pipe dream was that I could expand this to include a
GUI and make it into an open source project eventually. Pretty much
like 'Bandwidth Monitor' shown in the link above.)


thanks,


--
Mark

On Wed, Apr 2, 2008 at 12:25 PM, Mark <markonlinux@internode.on.net> wrote:
> Hi all,
>
> Is there some code somewhere (library/script) that I can look at
> that will with the following:
>
> I would like to monitor *all* traffic along the lines of
> http://www.bwmonitor.com/ on whatever network(s) is/are active at the
> time. Wireless and/or Ethernet.
>
> Is there a way to monitor traffic in general moving across say wlan0
> rather than specific protocols/ports (HTTP, FTP, etc)?
>
> A Ruby solution would be good but Java/Python/Perl/ would be OK as well.
>
> (The pipe dream was that I was going to try to write something like this
> in all the languages above as a way to evaluate each of them).
>
> (The even bigger pipe dream was that I could expand this to include a
> GUI and make it into an open source project eventually. Pretty much
> like 'Bandwidth Monitor' shown in the link above.)
>
>
> thanks,

Take a look at the ifstat program.

^ manveru

Mark wrote:
> Hi all,
>
> Is there some code somewhere (library/script) that I can look at
> that will with the following:
>
> I would like to monitor *all* traffic along the lines of
> http://www.bwmonitor.com/ on whatever network(s) is/are active at the
> time. Wireless and/or Ethernet.
>
> Is there a way to monitor traffic in general moving across say wlan0
> rather than specific protocols/ports (HTTP, FTP, etc)?
>
> A Ruby solution would be good but Java/Python/Perl/ would be OK as well.
>
> (The pipe dream was that I was going to try to write something like this
> in all the languages above as a way to evaluate each of them).
>
> (The even bigger pipe dream was that I could expand this to include a
> GUI and make it into an open source project eventually. Pretty much
> like 'Bandwidth Monitor' shown in the link above.)
>
>
> thanks,
>
>

There are literally hundreds of tools that do exactly that, many of them
open source. However, as the saying goes, "With great power comes great
responsibility."

1. You haven't specified what "all" means. Is it all the traffic in and
out of one specific host, all the traffic in an enterprise, etc.? The
more network segments you care about, the tougher the job becomes and
the bigger the risks are.

2. There are, in addition to hundreds of tools, hundreds -- no, millions
-- of privacy and security concerns associated with network monitoring.

A good place to start is with RRDTool, an open source package that runs
on most platforms, including Windows, and has a Ruby binding.

On Wed, Apr 2, 2008 at 3:47 PM, M. Edward (Ed) Borasky
<znmeb@cesmail.net> wrote:
> A good place to start is with RRDTool, an open source package that runs on
> most platforms, including Windows, and has a Ruby binding.

Offtopic: Do you know of a windows rrd binding? In recent thread [1]
the poster had problems with installing RubyRRDtool gem.

[1] http://blade.nagaokaut.ac.jp/cgi-bin...by-talk/296457

On Wed, Apr 2, 2008 at 5:25 AM, Mark <markonlinux@internode.on.net> wrote:
> Hi all,
>
> Is there some code somewhere (library/script) that I can look at
> that will with the following:
>
> I would like to monitor *all* traffic along the lines of
> http://www.bwmonitor.com/ on whatever network(s) is/are active at the
> time. Wireless and/or Ethernet.
>
> Is there a way to monitor traffic in general moving across say wlan0
> rather than specific protocols/ports (HTTP, FTP, etc)?
>
> A Ruby solution would be good but Java/Python/Perl/ would be OK as well.
>
> (The pipe dream was that I was going to try to write something like this
> in all the languages above as a way to evaluate each of them).
>
> (The even bigger pipe dream was that I could expand this to include a
> GUI and make it into an open source project eventually. Pretty much
> like 'Bandwidth Monitor' shown in the link above.)
>
>
> thanks,
>
>
> --
> Mark

Keep in mind, too, that you need the port on the switch/router/gateway
that you are on to be promiscuous.

Todd

On 2 Apr 2008, at 14:47, M. Edward (Ed) Borasky wrote:
> Mark wrote:
>> Hi all,
>> Is there some code somewhere (library/script) that I can look at
>> that will with the following:
>> I would like to monitor *all* traffic along the lines of
>> http://www.bwmonitor.com/ on whatever network(s) is/are active at the
>> time. Wireless and/or Ethernet.
>> Is there a way to monitor traffic in general moving across say wlan0
>> rather than specific protocols/ports (HTTP, FTP, etc)?
>> A Ruby solution would be good but Java/Python/Perl/ would be OK as
>> well.
>> (The pipe dream was that I was going to try to write something like
>> this
>> in all the languages above as a way to evaluate each of them).
>> (The even bigger pipe dream was that I could expand this to include a
>> GUI and make it into an open source project eventually. Pretty much
>> like 'Bandwidth Monitor' shown in the link above.)
>> thanks,
>>
>
> There are literally hundreds of tools that do exactly that, many of
> them open source. However, as the saying goes, "With great power
> comes great responsibility."
>
> 1. You haven't specified what "all" means. Is it all the traffic in
> and out of one specific host, all the traffic in an enterprise,
> etc.? The more network segments you care about, the tougher the job
> becomes and the bigger the risks are.
>
> 2. There are, in addition to hundreds of tools, hundreds -- no,
> millions -- of privacy and security concerns associated with network
> monitoring.
>
> A good place to start is with RRDTool, an open source package that
> runs on most platforms, including Windows, and has a Ruby binding.

Also libpcap has Ruby bindings if you just want to catch packets and
examine them. You can find basic details in the Camping presentation
at the link in my sig.


Ellie

Eleanor McHugh
Games With Brains
http://slides.games-with-brains.net
----
raise ArgumentError unless @reality.responds_to? :reason

Eleanor McHugh wrote:
> Also libpcap has Ruby bindings if you just want to catch packets and
> examine them. You can find basic details in the Camping presentation at
> the link in my sig.

I deliberately avoided mention of libpcap because of the "great
power/great responsibility" issue. I don't want any Rubyists getting
hurt.

Jano Svitok wrote:
> On Wed, Apr 2, 2008 at 3:47 PM, M. Edward (Ed) Borasky
> <znmeb@cesmail.net> wrote:
>> A good place to start is with RRDTool, an open source package that runs on
>> most platforms, including Windows, and has a Ruby binding.
>
> Offtopic: Do you know of a windows rrd binding? In recent thread [1]
> the poster had problems with installing RubyRRDtool gem.
>
> [1] http://blade.nagaokaut.ac.jp/cgi-bin...by-talk/296457
>
>

Well ... RRDTool does run on Windows and I know there's a Perl binding.
IIRC it requires Perl to even run. I suspect a Windows Ruby binding
could be made.

On 3 Apr 2008, at 04:27, M. Edward (Ed) Borasky wrote:
> Eleanor McHugh wrote:
>> Also libpcap has Ruby bindings if you just want to catch packets
>> and examine them. You can find basic details in the Camping
>> presentation at the link in my sig.
>
> I deliberately avoided mention of libpcap because of the "great
> power/great responsibility" issue. I don't want any Rubyists getting
> hurt.

yes, don't do this at home kiddies - innocent packets may die lol


Ellie

Eleanor McHugh
Games With Brains
http://slides.games-with-brains.net
----
raise ArgumentError unless @reality.responds_to? :reason

Hi Ed,

On Wed, 2 Apr 2008 08:47:47 -0500
"M. Edward (Ed) Borasky" <znmeb@cesmail.net> wrote:

>
> There are literally hundreds of tools that do exactly that, many of
> them open source. However, as the saying goes, "With great power
> comes great responsibility."

that's scary ;-)

> 1. You haven't specified what "all" means. Is it all the traffic in
> and out of one specific host, all the traffic in an enterprise, etc.?
> The more network segments you care about, the tougher the job becomes
> and the bigger the risks are.

>> whatever network(s) is/are active at the time
^^^^^^^^^

Yes, definitely wrong choice of words. Network adapter would have been
more appropriate.

>
> 2. There are, in addition to hundreds of tools, hundreds -- no,
> millions -- of privacy and security concerns associated with network
> monitoring.

I'm not interested in what the packets contain, just how many packets
are passing across the network adapter (NIC).
ie a download/upload rate. Regardless of what protocol is involved (FTP
or HTTP etc).

For example, I'm downloading Ubuntu updates as we speak and suspect its
going a tad slowly. Because I have this mail window maximized I can't
see Update Managers dialog so can't see the Download Rate (18.2Kb/sec
by the way. Which *is* slow ;-().

What I'd eventually like is (both of these would be applets on a gnome
panel for eg):

1 - to have something similar to the System Monitors CPU History graph,
but showing download speed.

or

2 - even just '18.2Kb/s' displayed on the panel (updates at a specified
refresh rate). Much like a temperature applet displays 17 degrees C
for eg.


sorry for the inaccuracy,


--
Mark