9:23 a.m.
My ISP limits my usage to 17 gB per 30 days and updates this number
continuously, the exact manner by which this is computed is n unknown to
me and possibly to them too? But I have been fighting this problem for
a number of weeks now having been warned once that I had exceeded the
80% point [13.6 gB]. We have used the system pretty much without
concern for usage for more than a year so this is new.
I have four computers connected to the LAN with internet access. This
F7 box, an Apple Mac, and two MS XP computers.
One of the XP boxes is my teen aged [15 yrs, twins] grandson's. In the
process of trying to get usage under control I had physically removed
their access device [Linksys WET11]. After getting our usage reduced to
about 6 gB from 15+ not long ago I gave them back the internet device
and enabled access to iTunes this last weekend since one boy wanted to
download some music. I left the Netgear [WGR614v6] router unblocked for
about an hour and they collected what ever it was they wanted and I
restored it to blocked again.
What else they did with the computer, what sites they visited, I don't
know but they are limited by what I've blocked in the router and some
parental control software I also subscribe to.
However once they were allowed back on line it appears that our usage
score per the [Wildblue indications] has begun to skyrocket again, about
800 megs in the day following their system reconnection. It looks to me
like most iTunes downloads are on the order of 5 mB, 800 mB at the speed
we have would take more than an hour. Most of the time their computer
has been turned off. I have VNC installed and if I see it on and not in
use [I check the Netgear router] I shut their computer off.
My question is is it possible that some site they have visited triggers
something that is driving our usage up even though all the computers are
powered down leaving only mine and the Netgear router running. Even
then when I am not using the internet I usually "deactivate" it via
"system control network."
Gkrellm seems to keep an accurate reading of what I am using in this
computer, both upload and download so I don't think I am causing the
problem and it seems to have restarted since I re-enabled the kids XP box.
Any suggestions as to what to look for will be appreciated.
Bob Goodwin Zuni, Virginia
2:28 p.m.
On Nov 11, 2007 12:33 PM, Bob Goodwin <bobgoodwin(a)wildblue.net> wrote:
Tim wrote:
> On Sun, 2007-11-11 at 10:22 -0500, Bob Goodwin wrote:
>
>> Can someone suggest what I need to put in the config file to view
>> everything happening on eth0? I have not yet put anything in config.
>>
>
> It's absolutely ages since I set up MRTG to watch my router. I did it
> the hard way, first. Pouring over documentation to work out what to put
> into the configuration file. Later, I played with the /usr/bin/cfgmaker
> tool that comes with it.
>
> Investigate the different files you find listed with: rpm -ql mrtg
>
>
/usr/bin/cfgmaker
Usage:
cfgmaker [options] [community@]router [[options] [community@]router ...]
I can probably muddle through the options with a few trials but I am
lost with "community@]router"
My router is known only as 192.168.1.1 but I'm looking at the output of
the Wildblue receiver/modem and don't know how to address this except as
eth0 on box10, the computer in which mrtg resides.
If the modem does not support snmp, or you can not configure the
community on it, you may need to configure a Linux as router, make all
traffic to cross it, and then point MRTG to one of the interfaces of
that PC
--
Guillermo Garron
"Linux IS user friendly... It's just selective about who its friends are."
(Using FC6, CentOS4.4 and Ubuntu 6.06)
http://www.go2linux.org
6:06 p.m.
Alan Cox wrote:
> Gkrellm seems to keep an accurate reading of what I am using in
this
> computer, both upload and download so I don't think I am causing the
> problem and it seems to have restarted since I re-enabled the kids XP box.
>
> Any suggestions as to what to look for will be appreciated.
I would (and do) install my own firewall. I use shorewall, often on
Debian (as I just mentioned in another thread)m but I also have one on
CentOS4.
There's no reason you can't do it on you Fedora box, and with your
hardware I would.
I would explicitly block everything, coming and going, and allow what I
must. Require them to use your proxy for web access.
Typically I allow ssh to anywhere, from only places I may visit, smtp to
everywhere, from everywhere except those who've offended my (mostly
Chinese universities, bot not all Asian, some are in Europe or between).
http{,s} to.from everywhere, UDP domain and ntp to everywhere.
I watch the logs, and open other stuff when I need.
Like you, I need to control some teenagers (I do it a school for "youth
at risk.") I run squid (also caches stuff, reduces downloads) and
squidguard with some publicly-available blocklists, plus our own lists.
Amongst sites we block that come to mind:
proxy.org
facebook
youtube
Any other social/chat sites we notice
Numeric IP addresses (blocks google cache and other sites)
msn - we allow google search via our own search form that enforces safe
search
Sarg reports popular sites, and those are good candidates to block.
Squid has the ability to block some download types, and we do. They do
not download videos or other "bad" content.
You really really need to look at the traffic to and from the internet
connection to see what is going on (and to know how your ISP measures)
If you've got a dumb ISP which simply measures traffic aimed at your box
then anyone who happens to have fallen out with the kids involved can
simply spew data at you. If its a wireless link someone may well be
cracking that and using your bandwidth in bulk, it could be viruses on
the windows box - anything.
Until you look at the traffic you are doing the equivalent of trying to
work out where the water is coming from during a flood by measuring the
depth - yes it'll tell you that there is a problem, but it won't tell you
why..
There's some monitoring software which you can run that produces pretty
graphs of your traffic. You can see when it happens.
summer@Bandicoot:~$ apt-cache search ^mrtg
cfgstoragemaker - MRTG config generator for storage monitoring via SNMP
mrtg - multi router traffic grapher
mrtg-contrib - multi router traffic grapher (contributed files)
mrtg-ping-probe - Ping module for Multi Router Traffic Grapher
mrtg-rrd - The script for generating graphs for MRTG statistics
mrtgutils - Utilities to generate statistics for mrtg
summer@Bandicoot:~$
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
11:19 a.m.
On Tue, Oct 30, 2007 at 11:09:12 -0400,
Bob Goodwin <bobgoodwin(a)wildblue.net> wrote:
I need to find what is driving the usage numbers, they were dropping
until about a week ago. The solution may be to put the boys back on a
dial-up or their mother may just leave them without internet? But that
doesn't define/identify the problem.
You might try a traffic shaping solution. Linux provides very powerful
traffic shaping tools. Using them still takes a bit of learning, but if
you can figure out how to distinguish the different categories of traffic,
you should be able to prioritize or limit it in a way that meets your needs.
11:22 a.m.
on 10/30/2007 12:04 PM, Bob Goodwin wrote:
Scott van Looy wrote:
> Run the spyware detection stuff at www.prevx.com on the XP machine,
> see if there's any spyware. Often spyware can be a cause of mystery
> bandwidth stealing
>
>
>
I ran the free scan on the boy's XP computer and it reports clean!
I will get their father to do the same on his XP computer later today.
I don't want to mess with his but he will do it himself when I ask ...
A simple test.
Click on the Start button (same place a the KDE button)
Click on Network Connections
Click on Local Area connections
You will see an activity section in the window.
With the computer connected to the LAN there should/could be a little,
very little activity from LAN. Handshaking.
As long as 'you' are not doing anything on The Internet it should not
change much when connected to The Internet. If it jumps then something is
using your computer and burning up your time.
--
David
10:27 a.m.
Today Bob Goodwin did spake thusly:
Ed Greshko wrote:
> May I make a simple suggestion as it sounds as if you are fighting a battle
> that will continue to be fought? Keep in mind that I forgot the family
> dynamics in play.
>
> Is your connection to the internet ADSL? If so, why not just get a second
> phone line for ADSL only and another ISP account that is dedicated to the
> twins to use. Maybe you can get it for a discount as you have one account
> already and maybe you can get them a lower usage level. If they use it up,
> so be it. You are unaffected. Your choice as to who pay the freight.
>
>
The family dynamics are good, everyone is cooperating, the kids I can manage.
ADSL and Cable are not options in this rural area. It's either the satellite
connection or Verizon dial-up. We suffered with dial-up for several years,
we had two lines actually, canceled those and changed to this Wildblue
account which works well normally.
I need to find what is driving the usage numbers, they were dropping until
about a week ago. The solution may be to put the boys back on a dial-up or
their mother may just leave them without internet? But that doesn't
define/identify the problem.
Run the spyware detection stuff at www.prevx.com on the XP machine, see if
there's any spyware. Often spyware can be a cause of mystery bandwidth
stealing
--
Scott van Looy - email:me@ethosuk.org.uk | web:www.ethosuk.org.uk
site:www.freakcity.net - the in place for outcasts since 2003
PGP Fingerprint: 7180 5543 C6C4 747B 7E74 802C 7CF9 E526 44D9 D4A7
-------------------------------------------
|/// /// /// /// WIDE LOAD /// /// /// ///|
-------------------------------------------
The monitor is plugged into the serial port
10:09 a.m.
Ed Greshko wrote:
May I make a simple suggestion as it sounds as if you are fighting a
battle
that will continue to be fought? Keep in mind that I forgot the family
dynamics in play.
Is your connection to the internet ADSL? If so, why not just get a second
phone line for ADSL only and another ISP account that is dedicated to the
twins to use. Maybe you can get it for a discount as you have one account
already and maybe you can get them a lower usage level. If they use it up,
so be it. You are unaffected. Your choice as to who pay the freight.
The family dynamics are good, everyone is cooperating, the kids I can
manage.
ADSL and Cable are not options in this rural area. It's either the
satellite connection or Verizon dial-up. We suffered with dial-up for
several years, we had two lines actually, canceled those and changed to
this Wildblue account which works well normally.
I need to find what is driving the usage numbers, they were dropping
until about a week ago. The solution may be to put the boys back on a
dial-up or their mother may just leave them without internet? But that
doesn't define/identify the problem.
Bob Goodwin
.
9:54 a.m.
Bob Goodwin wrote:
My ISP limits my usage to 17 gB per 30 days and updates this number
continuously, the exact manner by which this is computed is n unknown to
me and possibly to them too? But I have been fighting this problem for
a number of weeks now having been warned once that I had exceeded the
80% point [13.6 gB]. We have used the system pretty much without
concern for usage for more than a year so this is new.
I have four computers connected to the LAN with internet access. This
F7 box, an Apple Mac, and two MS XP computers.
One of the XP boxes is my teen aged [15 yrs, twins] grandson's. In the
process of trying to get usage under control I had physically removed
their access device [Linksys WET11]. After getting our usage reduced to
about 6 gB from 15+ not long ago I gave them back the internet device
and enabled access to iTunes this last weekend since one boy wanted to
download some music. I left the Netgear [WGR614v6] router unblocked for
about an hour and they collected what ever it was they wanted and I
restored it to blocked again.
What else they did with the computer, what sites they visited, I don't
know but they are limited by what I've blocked in the router and some
parental control software I also subscribe to.
However once they were allowed back on line it appears that our usage
score per the [Wildblue indications] has begun to skyrocket again, about
800 megs in the day following their system reconnection. It looks to me
like most iTunes downloads are on the order of 5 mB, 800 mB at the speed
we have would take more than an hour. Most of the time their computer
has been turned off. I have VNC installed and if I see it on and not in
use [I check the Netgear router] I shut their computer off.
My question is is it possible that some site they have visited triggers
something that is driving our usage up even though all the computers are
powered down leaving only mine and the Netgear router running. Even
then when I am not using the internet I usually "deactivate" it via
"system control network."
Gkrellm seems to keep an accurate reading of what I am using in this
computer, both upload and download so I don't think I am causing the
problem and it seems to have restarted since I re-enabled the kids XP box.
Any suggestions as to what to look for will be appreciated.
May I make a simple suggestion as it sounds as if you are fighting a battle
that will continue to be fought? Keep in mind that I forgot the family
dynamics in play.
Is your connection to the internet ADSL? If so, why not just get a second
phone line for ADSL only and another ISP account that is dedicated to the
twins to use. Maybe you can get it for a discount as you have one account
already and maybe you can get them a lower usage level. If they use it up,
so be it. You are unaffected. Your choice as to who pay the freight.
3:34 p.m.
On Oct 30, 2007 8:09 AM, Bob Goodwin <bobgoodwin(a)wildblue.net> wrote:
Ed Greshko wrote:
> May I make a simple suggestion as it sounds as if you are fighting a battle
> that will continue to be fought? Keep in mind that I forgot the family
> dynamics in play.
>
> Is your connection to the internet ADSL? If so, why not just get a second
> phone line for ADSL only and another ISP account that is dedicated to the
> twins to use. Maybe you can get it for a discount as you have one account
> already and maybe you can get them a lower usage level. If they use it up,
> so be it. You are unaffected. Your choice as to who pay the freight.
>
>
The family dynamics are good, everyone is cooperating, the kids I can
manage.
ADSL and Cable are not options in this rural area. It's either the
satellite connection or Verizon dial-up. We suffered with dial-up for
several years, we had two lines actually, canceled those and changed to
this Wildblue account which works well normally.
I need to find what is driving the usage numbers, they were dropping
until about a week ago. The solution may be to put the boys back on a
dial-up or their mother may just leave them without internet? But that
doesn't define/identify the problem.
Bob Goodwin
.
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Hi Bob Goodwin!
I would be tempted to obtain a cheap "boot only" box from a recycler
and set up a sniffer to quantify what is going on with the particular
interfaces.
It may be possible to get an idea on the Linux box with tcpdump and ethereal.
There are many network traffic analyzers out there, Google "linux
network traffic analyzer".
Also, many are available along with Linux live CDs so you could turn
one of your boxes into a statistics gathering tool to find out (Google
"Linux Security Live CD").
Good Hunting!
Tod
6:14 p.m.
On Wed, 31 Oct 2007 08:10:39 +0900
John Summerfield <debian(a)herakles.homelinux.org> wrote:
until you know
whether the kids (or someone else) is deliberately doing it, even
possibly without knowing it, you won't know whether it's fixed.
The phrase "lowering of the boom" seems appropriate here.
--
MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com
2:26 p.m.
On Tuesday 30 October 2007 13:49:10 Bob Goodwin wrote:
David Boles wrote:
> A simple test.
>
> Click on the Start button (same place a the KDE button)
>
> Click on Network Connections
>
> Click on Local Area connections
>
> You will see an activity section in the window.
>
> With the computer connected to the LAN there should/could be a little,
> very little activity from LAN. Handshaking.
>
> As long as 'you' are not doing anything on The Internet it should not
> change much when connected to The Internet. If it jumps then something is
> using your computer and burning up your time.
It took me a while but I finally realized these are instructions for
Windows. I normally use XFCE and brought up a second window with Gnome
but none of this worked!
I will have to venture into the teen agers room once more!
Make sure your shots are up to date. :)
Thanks.
Bob Goodwin
--
Cheers. Gene
"There are 4 boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order"
-Ed Howdershelt (Author)
12:49 p.m.
David Boles wrote:
A simple test.
Click on the Start button (same place a the KDE button)
Click on Network Connections
Click on Local Area connections
You will see an activity section in the window.
With the computer connected to the LAN there should/could be a little,
very little activity from LAN. Handshaking.
As long as 'you' are not doing anything on The Internet it should not
change much when connected to The Internet. If it jumps then something is
using your computer and burning up your time.
It took me a while but I finally realized these are instructions for
Windows. I normally use XFCE and brought up a second window with Gnome
but none of this worked!
I will have to venture into the teen agers room once more!
Thanks.
Bob Goodwin
6:10 p.m.
Scott van Looy wrote:
Today Bob Goodwin did spake thusly:
ithout internet? But
> that doesn't define/identify the problem.
Run the spyware detection stuff at www.prevx.com on the XP machine, see
if there's any spyware. Often spyware can be a cause of mystery
bandwidth stealing
really, you need to measure the problem (mrtg) to help decide what the
problem is. Microsoft's malware removal kit it worth running for reasons
unconnected to this problem, and may well help, but until you know
whether the kids (or someone else) is deliberately doing it, even
possibly without knowing it, you won't know whether it's fixed.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
11:10 a.m.
on 10/30/2007 12:04 PM, Bob Goodwin wrote:
Scott van Looy wrote:
> Run the spyware detection stuff at www.prevx.com on the XP machine,
> see if there's any spyware. Often spyware can be a cause of mystery
> bandwidth stealing
>
>
>
I ran the free scan on the boy's XP computer and it reports clean!
I will get their father to do the same on his XP computer later today.
I don't want to mess with his but he will do it himself when I ask ...
Virus scanners usually only find what they already know about when they
scan. ;-)
--
David
11:04 a.m.
Scott van Looy wrote:
Run the spyware detection stuff at www.prevx.com on the XP machine,
see if there's any spyware. Often spyware can be a cause of mystery
bandwidth stealing
I ran the free scan on the boy's XP computer and it reports clean!
I will get their father to do the same on his XP computer later today.
I don't want to mess with his but he will do it himself when I ask ...
Thanks.
Bob Goodwin
9:41 a.m.
Gkrellm seems to keep an accurate reading of what I am using in this
computer, both upload and download so I don't think I am causing the
problem and it seems to have restarted since I re-enabled the kids XP box.
Any suggestions as to what to look for will be appreciated.
You really really need to look at the traffic to and from the internet
connection to see what is going on (and to know how your ISP measures)
If you've got a dumb ISP which simply measures traffic aimed at your box
then anyone who happens to have fallen out with the kids involved can
simply spew data at you. If its a wireless link someone may well be
cracking that and using your bandwidth in bulk, it could be viruses on
the windows box - anything.
Until you look at the traffic you are doing the equivalent of trying to
work out where the water is coming from during a flood by measuring the
depth - yes it'll tell you that there is a problem, but it won't tell you
why..
Alan
1:58 p.m.
On Thu, 2007-11-15 at 13:22 -0500, Bob Goodwin wrote:
Tim wrote:
> On Sun, 2007-11-11 at 14:59 -0500, Bob Goodwin wrote:
>
>> I have a system diagram you can view at:
>>
>> http://users.wildblue.net/bobgoodwin/sys071031.png
>>
>
> Well, looking at your network, you could use MRTG with the 192.168.1.1
> device to measure the traffic going through your LAN (and for anything
> outside that managed to connect to it through your wireless networking).
> All your LAN traffic (including intruders) goes through it before making
> out to your microwave internet connection.
>
> I think you'd only need to try and directly measure the wildblue
> receiver if it was capable of wireless connections directly with someone
> else. Is it wired to the dish, or does it use a wireless link between
> the receiver box and the dish?
>
> You could probably, also, use MRTG on the other wireless LAN
> switches/bridges, to see which ones are the busy ones. Though that'd
> mean a plethora of different graphs. If you wanted to trace out where
> the traffic was coming from, I think you'd want to log your 192.168.1.1
> device quite thoroughly, when run a logging analysis tool on it, rather
> than just a MRTG graph.
>
>
Yes, I agree, I really don't want graphical information. I was just
curious to see mrtg work, unfortunately I haven't had any success with
it and my problems with usage are demanding immediate attention!
"tcpdump" looks like it should produce the kind if information I need
and it certainly cranks out a long list in short order but I haven't
been able to find anything of significance [to me] in it? Although it's
being fed from the ethernet hub connected at the modem before the router
most of what I see is dns inquiries from box10 [192.168.1.10] connected
to it?
Try a filter on tcpdump like:
tcpdump ip and not net 192.168.1.0 mask 255.255.255.0
That will cause the system to dump any packets NOT destined for your
network.
Linksys identifies the hub as "EFAH05W - EtherFast® 10/100
5-port
Auto-Sensing Hub." I'm not sure what it "auto-senses?" but I hope it
is
passing everything it sees at its input.
It autosenses between 10Mbps and 100Mbps links.
I also tried "iptraf" which collected data for a couple of days but
showed something on the order of 20 mB received while Wildblue claimed I
used a lot more. See my notes below:
11/12/2007 17:05:25 949 8626
11/13/2007 03:17:39 1001 9072 +446 mB in 8 hours and 12
minutes!
Almost half a gigaByte download increase overnight, plus 52
mB uploaded!
The curious thing is that this does not agree with my
measurements of data transferred at the ethernet connection
at the Wildblue receiver over the last 58.43 hours? I show
show 18.3 mB incoming and 2.1 mB outgoing. Am I only seeing
traffic addressed to my computer? I need to verify that
part of my test setup.
This morning my activity has continued to go up despite our best efforts
to control it.
11/15/2007 12:20:13 1231 10177
Any suggestions as to how best to use tcpdump or iptraf would be
appreciated. I'm not even certain that my attempt to measure activity
has not caused an increase? I guess I'm really in over my head ...
Bob Goodwin
----------------------------------------------------------------------
- Rick Stevens, Principal Engineer rstevens(a)internap.com -
- CDN Systems, Internap, Inc. http://www.internap.com -
- -
- We have enough youth, how about a fountain of SMART? -
----------------------------------------------------------------------
2:41 p.m.
Rick Stevens wrote:
Try a filter on tcpdump like:
tcpdump ip and not net 192.168.1.0 mask 255.255.255.0
That will cause the system to dump any packets NOT destined for your
network.
tcpdump ip and not net 192.168.1.0 mask 255.255.255.0 On box10 connected to the hub I get
and error:
"Mask syntax for networks only"
tcpdump ip and not net 192.168.1.0 produces another error: "Syntax error in filter
expression"
> Linksys identifies the hub as "EFAH05W - EtherFast® 10/100
5-port
> Auto-Sensing Hub." I'm not sure what it "auto-senses?" but I hope
it is
> passing everything it sees at its input.
>
It autosenses between 10Mbps and 100Mbps links.
Hopefully that's all it senses.
3:10 a.m.
On Tue, 2007-10-30 at 13:34 -0700, Tod Merley wrote:
On Oct 30, 2007 8:09 AM, Bob Goodwin <bobgoodwin(a)wildblue.net>
wrote:
> Ed Greshko wrote:
> > May I make a simple suggestion as it sounds as if you are fighting a battle
> > that will continue to be fought? Keep in mind that I forgot the family
> > dynamics in play.
> >
> > Is your connection to the internet ADSL? If so, why not just get a second
> > phone line for ADSL only and another ISP account that is dedicated to the
> > twins to use. Maybe you can get it for a discount as you have one account
> > already and maybe you can get them a lower usage level. If they use it up,
> > so be it. You are unaffected. Your choice as to who pay the freight.
> >
> >
> The family dynamics are good, everyone is cooperating, the kids I can
> manage.
>
> ADSL and Cable are not options in this rural area. It's either the
> satellite connection or Verizon dial-up. We suffered with dial-up for
> several years, we had two lines actually, canceled those and changed to
> this Wildblue account which works well normally.
>
> I need to find what is driving the usage numbers, they were dropping
> until about a week ago. The solution may be to put the boys back on a
> dial-up or their mother may just leave them without internet? But that
> doesn't define/identify the problem.
>
> Bob Goodwin
>
>
Forgive me if this has already been addressed (I must admit that I've
skipped a lot of threads lately), but, is it maybe possible that the
boxes in question are simply part of some P2P stuff going on? Teenage
boys do indeed love their [porn|mp3's|warez crap|bootleg movies|cracked
software|fill in the blank].
Andy
1:59 p.m.
Tim wrote:
On Sun, 2007-11-11 at 13:45 -0500, Bob Goodwin wrote:
> Ok, but I am not trying to look at the router output I need an address
> for the Wildblue supplied receiver/modem device and I don't know hos
> to address that or even find it's address.
>
It may be a router, or it may be just a modem. That depends on the
device, and the configuration (some can be configured to be a router, or
just a bridge).
Your email headers show a private IP address and a public one, so I'm
presuming that you have a router in your network.
Received: from [192.168.1.6] (70-41-148-215.cust.wildblue.net
[70.41.148.215]) by mail1.wildblue.net (Postfix)
Does your modem have a way of being configured, or is it just some black
box with no user adjustments at all? If it has a little webserver, you
can browse to it and see how its set up (router or bridge, and its IP
addresses).
> If I do an ifconfig it just gives me the address of the computer and a
> hardware address which I assume is the ethernet NIC. But none of
> this pertains to the Wildblue "modem."
>
No gateway? Hmm, same here. I'm sure there used to be a "gateway"
section in those results. Maybe I'm recalling when I used to have dial
up internet, and the ifconfig results for the ppp0 interface.
> I am lost ...
>
> IPTraf is happy with root@box10, could that be where I need to tell
> mrtg to go? I just want to view all the data on eth0.
>
You could try.
I'm guessing that you do have a router, you could try looking for it at
one of the common addresses for that private subnet, either
192.168.1.254 or 192.168.1.1 (x.x.x.254 being a common address for
routers, and the like, x.x.x.1 being another common address for the
first thing on the network).
I have a system diagram you can view at:
http://users.wildblue.net/bobgoodwin/sys071031.png
I have inserted the hub between the Wildblue receiver and the router.
The receiver is a blue box with lights indicating the usual functions
power on, locked to the st. sig., ethernet activity, two F connectors
for transmit and receive, plus an RJ45 providing a 10/100 connection.
The "Surfbeam" spec's I have in my notes give me no clue as to how to
address it.
192.168.1.1 addresses the router, that's no problem, I have addresses
for all the bridges and the printer, etc., just don"'t know how to reach
the receiver/modem whatever it is. They call it a low cost subscriber
terminal." The outside unit transmits 1 watt on 30 gHz and produces an
IF around 1 gHz which the receiver/modem deals with. The dish is about
60 cm.
The information you derive from my messages is from this computer which
is connected via the wireless LAN and the router. I have removed the
connection from box10 and connected it directly to the hub via the 50 ft
cat. 5 cable so it does not see the router.
Bob Goodwin
12:22 p.m.
Tim wrote:
On Sun, 2007-11-11 at 14:59 -0500, Bob Goodwin wrote:
> I have a system diagram you can view at:
>
> http://users.wildblue.net/bobgoodwin/sys071031.png
>
Well, looking at your network, you could use MRTG with the 192.168.1.1
device to measure the traffic going through your LAN (and for anything
outside that managed to connect to it through your wireless networking).
All your LAN traffic (including intruders) goes through it before making
out to your microwave internet connection.
I think you'd only need to try and directly measure the wildblue
receiver if it was capable of wireless connections directly with someone
else. Is it wired to the dish, or does it use a wireless link between
the receiver box and the dish?
You could probably, also, use MRTG on the other wireless LAN
switches/bridges, to see which ones are the busy ones. Though that'd
mean a plethora of different graphs. If you wanted to trace out where
the traffic was coming from, I think you'd want to log your 192.168.1.1
device quite thoroughly, when run a logging analysis tool on it, rather
than just a MRTG graph.
Yes, I agree, I really don't want graphical information. I was just
curious to see mrtg work, unfortunately I haven't had any success with
it and my problems with usage are demanding immediate attention!
"tcpdump" looks like it should produce the kind if information I need
and it certainly cranks out a long list in short order but I haven't
been able to find anything of significance [to me] in it? Although it's
being fed from the ethernet hub connected at the modem before the router
most of what I see is dns inquiries from box10 [192.168.1.10] connected
to it?
Linksys identifies the hub as "EFAH05W - EtherFast® 10/100 5-port
Auto-Sensing Hub." I'm not sure what it "auto-senses?" but I hope it
is
passing everything it sees at its input.
I also tried "iptraf" which collected data for a couple of days but
showed something on the order of 20 mB received while Wildblue claimed I
used a lot more. See my notes below:
11/12/2007 17:05:25 949 8626
11/13/2007 03:17:39 1001 9072 +446 mB in 8 hours and 12
minutes!
Almost half a gigaByte download increase overnight, plus 52
mB uploaded!
The curious thing is that this does not agree with my
measurements of data transferred at the ethernet connection
at the Wildblue receiver over the last 58.43 hours? I show
show 18.3 mB incoming and 2.1 mB outgoing. Am I only seeing
traffic addressed to my computer? I need to verify that
part of my test setup.
This morning my activity has continued to go up despite our best efforts
to control it.
11/15/2007 12:20:13 1231 10177
Any suggestions as to how best to use tcpdump or iptraf would be
appreciated. I'm not even certain that my attempt to measure activity
has not caused an increase? I guess I'm really in over my head ...
Bob Goodwin
11:21 p.m.
On Sun, 2007-11-11 at 14:59 -0500, Bob Goodwin wrote:
I have a system diagram you can view at:
http://users.wildblue.net/bobgoodwin/sys071031.png
Well, looking at your network, you could use MRTG with the 192.168.1.1
device to measure the traffic going through your LAN (and for anything
outside that managed to connect to it through your wireless networking).
All your LAN traffic (including intruders) goes through it before making
out to your microwave internet connection.
I think you'd only need to try and directly measure the wildblue
receiver if it was capable of wireless connections directly with someone
else. Is it wired to the dish, or does it use a wireless link between
the receiver box and the dish?
You could probably, also, use MRTG on the other wireless LAN
switches/bridges, to see which ones are the busy ones. Though that'd
mean a plethora of different graphs. If you wanted to trace out where
the traffic was coming from, I think you'd want to log your 192.168.1.1
device quite thoroughly, when run a logging analysis tool on it, rather
than just a MRTG graph.
--
(This box runs FC5, my others run FC4 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
9:40 p.m.
Bob Goodwin wrote:
This morning I installed MRTG but despite the documentation I have
not
been able to get it to display anything except :
I could be wrong...but doesn't MRTG use SNMP to gather statistics? If the
device you are attempting to monitor doesn't support SNMP then that is what
I would expect...nothing.
-----------------------------------------------------------------------
ERROR: Mrtg will most likely not work properly when the environment
variable LANG is set to UTF-8. Please run mrtg in an environment
where this is not the case. Try the following command to start:
env LANG=C /usr/bin/mrtg
-----------------------------------------------------------------------
and then:
------------------------------
env LANG=C /usr/bin/mrtg
Usage: mrtg <config-file>
mrtg-2.15.1 - Multi Router Traffic Grapher
Copyright 1995-2006 by Tobias Oetiker
Licensed under the Gnu GPL.
If you want to know more about this tool, you might want
to read the docs. You can find everything on the
mrtg website:
http://oss.oetiker.ch/mrtg/
-----------------------------------
Can someone suggest what I need to put in the config file to view
everything happening on eth0? I have not yet put anything in config.
Thanks.
Bob Goodwin
.
--
Writing is easy; all you do is sit staring at the blank sheet of paper until
drops of blood form on your forehead.
-- Gene Fowler
3:02 p.m.
Bob Goodwin wrote:
John Summerfield wrote:
> Bob Goodwin wrote:
>
>
>
>> http://oss.oetiker.ch/mrtg/
>>
>> -----------------------------------
>>
>> Can someone suggest what I need to put in the config file to view
>> everything happening on eth0? I have not yet put anything in config.
>
> Ah, yes. I've been meaning to install ClarkConnect to solve this very
> issue;-) Thanx for the reminder.
>
>
> Here's a fairly old one:
> [root@magpie root]# ls -l /etc/mrtg/mrtg.cfg
> -rw-r--r-- 1 root root 754 Feb 23 2002
> /etc/mrtg/mrtg.cfg
> [root@magpie root]# cat /etc/mrtg/mrtg.cfg
> ######################################################################
> # Multi Router Traffic Grapher -- Example Configuration File
> ######################################################################
> # This file is for use with mrtg-2.0
> #
> # Note:
> #
> # * Keywords must start at the begin of a line.
> #
> # * Lines which follow a keyword line which do start
> # with a blank are appended to the keyword line
> #
> # * Empty Lines are ignored
> #
> # * Lines starting with a # sign are comments.
>
> # Where should the logfiles, and webpages be created?
>
> # Minimal mrtg.cfg
> #--------------------
>
> WorkDir: /var/www/html/mrtg
> #Target[r1]: 2:public@myrouter.somplace.edu
> #MaxBytes[r1]: 1250000
> #Title[r1]: Traffic Analysis
> #PageTop[r1]: <H1>Stats for our Ethernet</H1>
>
> [root@magpie root]#
>
> Used to work, it's ages since I looked at the reports.
>
>
That's about what the config file says but the stickler is the address
"public(a)myrouter.somplace.edu"
Bob Goodwin
yeah, the system I quoted uses a genuine ADSL modem and pppoe. Probably,
we could get about the same report from it, but its default IP address
is used on a different, connected, LAN and I don't propose to fiddle
with it.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
2:17 p.m.
John Summerfield wrote:
Bob Goodwin wrote:
> http://oss.oetiker.ch/mrtg/
>
> -----------------------------------
>
> Can someone suggest what I need to put in the config file to view
> everything happening on eth0? I have not yet put anything in config.
Ah, yes. I've been meaning to install ClarkConnect to solve this very
issue;-) Thanx for the reminder.
Here's a fairly old one:
[root@magpie root]# ls -l /etc/mrtg/mrtg.cfg
-rw-r--r-- 1 root root 754 Feb 23 2002
/etc/mrtg/mrtg.cfg
[root@magpie root]# cat /etc/mrtg/mrtg.cfg
######################################################################
# Multi Router Traffic Grapher -- Example Configuration File
######################################################################
# This file is for use with mrtg-2.0
#
# Note:
#
# * Keywords must start at the begin of a line.
#
# * Lines which follow a keyword line which do start
# with a blank are appended to the keyword line
#
# * Empty Lines are ignored
#
# * Lines starting with a # sign are comments.
# Where should the logfiles, and webpages be created?
# Minimal mrtg.cfg
#--------------------
WorkDir: /var/www/html/mrtg
#Target[r1]: 2:public@myrouter.somplace.edu
#MaxBytes[r1]: 1250000
#Title[r1]: Traffic Analysis
#PageTop[r1]: <H1>Stats for our Ethernet</H1>
[root@magpie root]#
Used to work, it's ages since I looked at the reports.
That's about what the config file says but the stickler is the address
"public(a)myrouter.somplace.edu"
Bob Goodwin
1:52 p.m.
Tim wrote:
On Sun, 2007-11-11 at 13:45 -0500, Bob Goodwin wrote:
> Ok, but I am not trying to look at the router output I need an address
> for the Wildblue supplied receiver/modem device and I don't know hos
> to address that or even find it's address.
It may be a router, or it may be just a modem. That depends on the
device, and the configuration (some can be configured to be a router, or
just a bridge).
Whichever, it probably has an IP address. The docs that came with it
should know the default, and if not then try the vendors' website and
google.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
1:48 p.m.
Bob Goodwin wrote:
http://oss.oetiker.ch/mrtg/
-----------------------------------
Can someone suggest what I need to put in the config file to view
everything happening on eth0? I have not yet put anything in config.
Ah, yes. I've been meaning to install ClarkConnect to solve this very
issue;-) Thanx for the reminder.
Here's a fairly old one:
[root@magpie root]# ls -l /etc/mrtg/mrtg.cfg
-rw-r--r-- 1 root root 754 Feb 23 2002 /etc/mrtg/mrtg.cfg
[root@magpie root]# cat /etc/mrtg/mrtg.cfg
######################################################################
# Multi Router Traffic Grapher -- Example Configuration File
######################################################################
# This file is for use with mrtg-2.0
#
# Note:
#
# * Keywords must start at the begin of a line.
#
# * Lines which follow a keyword line which do start
# with a blank are appended to the keyword line
#
# * Empty Lines are ignored
#
# * Lines starting with a # sign are comments.
# Where should the logfiles, and webpages be created?
# Minimal mrtg.cfg
#--------------------
WorkDir: /var/www/html/mrtg
#Target[r1]: 2:public@myrouter.somplace.edu
#MaxBytes[r1]: 1250000
#Title[r1]: Traffic Analysis
#PageTop[r1]: <H1>Stats for our Ethernet</H1>
[root@magpie root]#
Used to work, it's ages since I looked at the reports.
--
Cheers
John
-- spambait
1aaaaaaa(a)coco.merseine.nu Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
Please do not reply off-list
1:16 p.m.
On Sun, 2007-11-11 at 13:45 -0500, Bob Goodwin wrote:
Ok, but I am not trying to look at the router output I need an
address
for the Wildblue supplied receiver/modem device and I don't know hos
to address that or even find it's address.
It may be a router, or it may be just a modem. That depends on the
device, and the configuration (some can be configured to be a router, or
just a bridge).
Your email headers show a private IP address and a public one, so I'm
presuming that you have a router in your network.
Received: from [192.168.1.6] (70-41-148-215.cust.wildblue.net
[70.41.148.215]) by mail1.wildblue.net (Postfix)
Does your modem have a way of being configured, or is it just some black
box with no user adjustments at all? If it has a little webserver, you
can browse to it and see how its set up (router or bridge, and its IP
addresses).
If I do an ifconfig it just gives me the address of the computer and
a
hardware address which I assume is the ethernet NIC. But none of
this pertains to the Wildblue "modem."
No gateway? Hmm, same here. I'm sure there used to be a "gateway"
section in those results. Maybe I'm recalling when I used to have dial
up internet, and the ifconfig results for the ppp0 interface.
I am lost ...
IPTraf is happy with root@box10, could that be where I need to tell
mrtg to go? I just want to view all the data on eth0.
You could try.
I'm guessing that you do have a router, you could try looking for it at
one of the common addresses for that private subnet, either
192.168.1.254 or 192.168.1.1 (x.x.x.254 being a common address for
routers, and the like, x.x.x.1 being another common address for the
first thing on the network).
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
12:45 p.m.
Tim wrote:
On Sun, 2007-11-11 at 11:33 -0500, Bob Goodwin wrote:
> /usr/bin/cfgmaker
> Usage:
> cfgmaker [options] [community@]router [[options]
> [community@]router ...]
>
>
> I can probably muddle through the options with a few trials but I am
> lost with "community@]router"
>
> My router is known only as 192.168.1.1 but I'm looking at the output
> of the Wildblue receiver/modem and don't know how to address this
> except as eth0 on box10, the computer in which mrtg resides.
>
A very brief synopsis:
"Router" in the "community@router" string being the address of the
router, if you were going to have MRTG plot traffic through a router.
The "community" part being the name for the group of SNMP information
provided from the router.
In my case, it's public@router, as the router is making some information
about it's operation available, when asked for the "public" data. I set
up the configuration file by running the cfgmaker command followed by
the public@router string. Then did a bit of tweaking to the
configuration file it created for me (some things didn't work, there was
some duplication, and I wanted to customise things).
On more elaborate gear, it might have one set of data available to
anybody who queries public@router, and other information might be
available with a different community name.
If your router isn't accessible by a hostname, then use the IP, or add
information to your resolver to allow the hostname to be associated with
the IP (could be done using the hosts file, or DNS).
Ok, but I am not trying to look at the router output I need an address
for the Wildblue supplied receiver/modem device and I don't know hos to
address that or even find it's address.
If I do an ifconfig it just gives me the address of the computer and a
hardware address which I assume is the ethernet NIC. But none of this
pertains to the Wildblue "modem."
I am lost ...
IPTraf is happy with root@box10, could that be where I need to tell mrtg
to go? I just want to view all the data on eth0.
Bob Goodwin
11:58 a.m.
On Sun, 2007-11-11 at 11:33 -0500, Bob Goodwin wrote:
/usr/bin/cfgmaker
Usage:
cfgmaker [options] [community@]router [[options]
[community@]router ...]
I can probably muddle through the options with a few trials but I am
lost with "community@]router"
My router is known only as 192.168.1.1 but I'm looking at the output
of the Wildblue receiver/modem and don't know how to address this
except as eth0 on box10, the computer in which mrtg resides.
A very brief synopsis:
"Router" in the "community@router" string being the address of the
router, if you were going to have MRTG plot traffic through a router.
The "community" part being the name for the group of SNMP information
provided from the router.
In my case, it's public@router, as the router is making some information
about it's operation available, when asked for the "public" data. I set
up the configuration file by running the cfgmaker command followed by
the public@router string. Then did a bit of tweaking to the
configuration file it created for me (some things didn't work, there was
some duplication, and I wanted to customise things).
On more elaborate gear, it might have one set of data available to
anybody who queries public@router, and other information might be
available with a different community name.
If your router isn't accessible by a hostname, then use the IP, or add
information to your resolver to allow the hostname to be associated with
the IP (could be done using the hosts file, or DNS).
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
10:33 a.m.
Tim wrote:
On Sun, 2007-11-11 at 10:22 -0500, Bob Goodwin wrote:
> Can someone suggest what I need to put in the config file to view
> everything happening on eth0? I have not yet put anything in config.
>
It's absolutely ages since I set up MRTG to watch my router. I did it
the hard way, first. Pouring over documentation to work out what to put
into the configuration file. Later, I played with the /usr/bin/cfgmaker
tool that comes with it.
Investigate the different files you find listed with: rpm -ql mrtg
/usr/bin/cfgmaker
Usage:
cfgmaker [options] [community@]router [[options] [community@]router ...]
I can probably muddle through the options with a few trials but I am
lost with "community@]router"
My router is known only as 192.168.1.1 but I'm looking at the output of
the Wildblue receiver/modem and don't know how to address this except as
eth0 on box10, the computer in which mrtg resides.
Any idea what goes there?
Bob Goodwin
10:04 a.m.
On Sun, 2007-11-11 at 10:22 -0500, Bob Goodwin wrote:
Can someone suggest what I need to put in the config file to view
everything happening on eth0? I have not yet put anything in config.
It's absolutely ages since I set up MRTG to watch my router. I did it
the hard way, first. Pouring over documentation to work out what to put
into the configuration file. Later, I played with the /usr/bin/cfgmaker
tool that comes with it.
Investigate the different files you find listed with: rpm -ql mrtg
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
9:22 a.m.
John Summerfield wrote:
Scott van Looy wrote:
> Today Bob Goodwin did spake thusly:
ithout internet? But
>> that doesn't define/identify the problem.
>
> Run the spyware detection stuff at www.prevx.com on the XP machine,
> see if there's any spyware. Often spyware can be a cause of mystery
> bandwidth stealing
>
>
>
really, you need to measure the problem (mrtg) to help decide what the
problem is. Microsoft's malware removal kit it worth running for
reasons unconnected to this problem, and may well help, but until you
know whether the kids (or someone else) is deliberately doing it, even
possibly without knowing it, you won't know whether it's fixed.
AT last I have an ethernet hub connected between the Wildblue satellite
receiver and the router, 50 ft. of cable snaking through the house to an
old Gateway 450 mHz computer running F7 and I have been looking at
"iptraf" for about 18 hours now trying to make some sense of what I'm
seeing.
I hope it is getting everything transferred through eth0! So far I
don't see enough activity to justify our high traffic indications but I
have had both Windows computers disconnected from the LAN while the
users are off on a camping trip.
This morning I installed MRTG but despite the documentation I have not
been able to get it to display anything except :
-----------------------------------------------------------------------
ERROR: Mrtg will most likely not work properly when the environment
variable LANG is set to UTF-8. Please run mrtg in an environment
where this is not the case. Try the following command to start:
env LANG=C /usr/bin/mrtg
-----------------------------------------------------------------------
and then:
------------------------------
env LANG=C /usr/bin/mrtg
Usage: mrtg <config-file>
mrtg-2.15.1 - Multi Router Traffic Grapher
Copyright 1995-2006 by Tobias Oetiker
Licensed under the Gnu GPL.
If you want to know more about this tool, you might want
to read the docs. You can find everything on the
mrtg website:
http://oss.oetiker.ch/mrtg/
-----------------------------------
Can someone suggest what I need to put in the config file to view
everything happening on eth0? I have not yet put anything in config.
Thanks.
Bob Goodwin
.
6005
days inactive
6021
days old
34 comments
14 participants
participants (14)
-
Alan Cox -
Andrew Kelly -
Bob Goodwin -
Bruno Wolff III -
David -
Ed Greshko -
Frank Cox -
Gene Heskett -
Guillermo Garron -
John Summerfield -
Rick Stevens -
Scott van Looy -
Tim -
Tod Merley