download accounting using ICS in XP

[Evan Dekker]

hi

we have a winXP server with a cable modem in our house and we have
about 5 other computers (also xp) using the server's ICS.

i am curious to now if there is some way to measure the amount of data
that is being sent over the internet (not local network traffic) on
each computer. i have tried a couple of connection monitoring
programs, but they all seem to measure the network traffic also, which
is not much help.

as far as i know, the ICS is just a microsoft-ism for a
proxy/firewall, and a friend suggested that i could maybe use an
output log or soemthing from the server, analyise it and determine how
many mb each machine is using from the internet.

does such a log exist? is there any progams i can use that do this
already? freeware/shareware? (don't really mind writing my own but why
re-invent the wheel?) if not, any suggestions on what i can look at to
determine this infomation myself? i have looked a little into SNMP,
but not quite sure if this is what i want.

any help appricated
cheers
evan

 

[Dave Lowther]

hi

we have a winXP server with a cable modem in our house and we have
about 5 other computers (also xp) using the server's ICS.

i am curious to now if there is some way to measure the amount of data
that is being sent over the internet (not local network traffic) on
each computer. i have tried a couple of connection monitoring
programs, but they all seem to measure the network traffic also, which
is not much help.

as far as i know, the ICS is just a microsoft-ism for a
proxy/firewall, and a friend suggested that i could maybe use an
output log or soemthing from the server, analyise it and determine how
many mb each machine is using from the internet.

does such a log exist? is there any progams i can use that do this
already? freeware/shareware? (don't really mind writing my own but why
re-invent the wheel?) if not, any suggestions on what i can look at to
determine this infomation myself? i have looked a little into SNMP,
but not quite sure if this is what i want.

I wrote my own. The approach I took was to use the WinPcap packet capture
library (freely available with samples just google for WinPcap).

At the ICS PC I run two captures, one for the LAN and one for the Internet
link (ISDN).

I capture all LAN packets where one of the src/dest IP addrs is not on the
LAN sub net, i.e. they are either outgoing or incoming to / from the
internet. So this way I can measure the amount of internet bandwidth (new
capture per second) each PC (excluding ICS PC) is using.

To get the figure for the ICS PC I capture everything off the internet link
and then subtract the sum of the LAN PC bandwidths. This is an estimate and
doesn't account for delays in packet transfer within the ICS PC. But it
works really well. I can see who is hogging the internet bandwidth.

In addition to showing real time internet usage for every PC, it's also
useful to see "if anything is happening" when IE appears to be stalled, i.e.
I can look on the bandwidth monitor screen and see wether it's "stalled"
because it's using 100% b/w to download something big.

BTW: By the time the packets get on to the internet link they no longer have
the 192.168.0.x address so it's not possible to directly measure each PCs
usage of the internet by just grabbing stuff of the internet link.

HTH

Dave.

 

[Dave Lowther]

I wrote my own. The approach I took was to use the WinPcap packet capture
library (freely available with samples just google for WinPcap).

<snip>
I forgot to say that I UDP broadcast the internet bandwidth usage on the LAN
@ 1Hz from the ICS PC, so a client on any PC on the LAN can view the
internet bandwidth usage.

Dave.

 

[Evan Dekker]

<snip>
I forgot to say that I UDP broadcast the internet bandwidth usage on the LAN
@ 1Hz from the ICS PC, so a client on any PC on the LAN can view the
internet bandwidth usage.

Dave.

thank you dave, i think this was exactly what i was looking for.