Trafic analysis tool

How can i analyze the traffic that is going through a rb450g device, the kind of analysis that can be done tracing all the packets?

i want to find out:

  1. where to i consume my bandwith (kb/sec): destination ip, protocol, port.
  2. where from: client ip/port…

with a time axis preferably.

You can use torch to see the current traffic going through the router.
http://wiki.mikrotik.com/wiki/Manual:Troubleshooting_tools#Torch_.28.2Ftool_torch.29

Or for advanced monitoring you have to use traffic flow:
http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow

As MRZ said, if you want to store this data and analyze it at a later date, your best option is going to be Netflows, or Traffic Flow in MikroTik. This requires you to set up a Netflows Collector on a server. There are several pay for options and several free options, depending on how much time/money you have to invest in getting it up and running will tell you what path you need to use. Pay for ones are generally very easy to set up, open source ones will require a lot of playing around on your part to get it up and running.

i’m not willing to paay for this – it seems something that sould be free.
i can do this using microsft isa server & sql server express for free, without genius knowledge, why should i pay for the same thing on mikrotik?

i’ve found paessler, it sould be free for up to 20 sensors. haven’t made it functional yet, i hope i dont need the netflow collector service, that’s not free.

i’ll keep looking. :frowning:

Like I said there are several “free” Net Flow collector programs out there. I have set up NTop and NFSen personally, both are free for the software used itself. The package is included on the MikroTik and is not something you need to pay extra for from them, but there is always some cost for servers, both in time and money. It all comes down to what features you want, if you want support for the product or not, and how fast you need it working. If you need the support for the software/sever and ease of setup, then no one is going to provide those services for free.

ideal would be a mom management pack.

i tried an netflow/snmp solution but i am not satisfied.

i want to use port mirroring (on an rb750 or an 250gs) and dump all the traffic to and sql server database (only headers, not including the payload).

does anyone know a tool that would capture all the traffic on an network card, select some header data and dump to an sql server database?

a free one.

thanks.

Wireshark, as far as it dumping stuff to a database though I don’t know.

wireshark won’t log to sql. design decision.