I've been consulted to detect the actual BW consumption of a Network and report should a BW Expansion is needed. A friend of mine, suspects that his ISP is not giving him the whole BW he has agreed on which is the BW he is paying for. Instead, they compensate for the BW shortage by using BW test (Dirty Trick! ) sometimes at peak hours from multiple strange routers on their network so he can still see the amount of BW agreed on at his up-link interface, but actually he notices very slow internet speed internally similar to what happens if he has consumed the whole BW. His agreement with the ISP states that he should provide the ISP Support with an account in order to trouble shoot once a customer (my friend in this case) reports an issue.
I need a Mechanism through which I can detect when someone is using that account to make BW Test to a specific router. I have configured an E-MAIL notification should a specific event occurred and the Logs printed that out. I've also installed a Syslog-sensor on PRTG monitoring System that can receive logs from that router and can notify someone via e-Mails and SMS should something wrong happened.. Is there any work around I can detect and LOG BW test login?