So I think I’ve got this up and running. I enabled SNMP and Traffic flow and set up a Traffic Flow Target and configured PRTG to interpret the data… and it seems to be working, but anytime I do a download to test, what I see is kind of… well, kind of useless.
I see a valid source IP from the Internet (let’s say Netflix) and I see Destination IP as my network’s WAN public IP address… regardless of which device on the network is receiving that traffic.
Then (way) further down the list, I see the reverse connection with the proper LAN device showing but now we’re logging a tiny bit of data.
I’m not saying it isn’t correct. It makes sense. The LAN computer sends a bit of data to Netflix to say “I want that” and then Netflix blasts a bunch of data to the public IP.
But for auditing purposes, what the hell good is that? I can see what outside services are being used, but I can’t tell who is using them!
If I’m using the wrong tool here then please enlighten me. Someone on my network is killing me on my data cap and I need to figure out what device(s) are responsible and what they are doing.