Top talkers

[#1]

I think it would be extremely useful if I could easily identify the top 5 IP addresses on each interface in terms of bandwidth utilization. As it is now I am lucky if I can figure out who/what is to blame. I guess this isn' t exactly a firewall feature, but it certainly would save me a lot of time when there is a problem with network utilization and it seems like it wouldn' t be too hard to implement as an on-demand feature - perhaps as a 5 or 10 second snapshot of utilization by IP.

[wcbenyip]

The FortiReporter SA or the firewall analyzer from eIQnetworks could fit for your requirement. Ref: http://www.fortinet.com/products/fortilog.html http://www.eiqnetworks.com/products/firewallanalyzer.shtml

[#3]

Thank you for the response. I agree, they would certainly do what I want, but I really think they would be overkill for occasional troubleshooting. Maybe once or twice a month we will experience very high utilization on our internet router and all I need is a quick usage snapshot to clue me in on where the problem is coming from. It could be done as an on-demand summary of some small period of time - maybe 10 or 15 seconds. If I could quickly narrow it down to one ort two IP addresses, then it would greatly simplify further investigation. Including something like this in the standard interface would probably generate interest in the Fortilog product for those who want to do this sort of thing 24x7 and/or in more detail.

[wcbenyip]

Support. I do think that they need to improve the box for further quck and easy troubleshooting and investigation. We are told by the vendor, the Fortilog product is just like a centralized device to collect the syslog and build-in with the FortiReporter SA, isn' t it?

[#5]

I installed a FortiReporter trial yesterday. I couldn' t get it to actually work (tech support recommended installing it on a clean, dedicated box), but I did discoiver that it won' t do live troubleshooting. It can tell you a lot about what happened 30-60 minutes after the fact, but that' s really not what I am looking for.

[JD_CDS]

I agree with this. I would also like to see a breakdown on the main interface maybe regarding protocols as a percentage of bandwidth and maybe the direction of the traffic. It might be nice to see that outbound http traffic is using 20%, inbound mail is using 10%, etc. I have seen some that have this feature. Would be nice to see this refreshed every 5 minutes to see traffic trending. Then the breakdown by top 5 talkers on top of that would help zoom in on a large influx of say web traffic to or from one ip address / DNS name

[#7]

It is funny that you should post this now. Up until 5 minutes ago was pulling my hair out trying to figure out where all of our bandwidth was going. I had the syslog set up and I kept coming up blank. Then, finally, the traffic problem stopped and the culprit showed up in the syslog as a single log entry for a 1.5GB file download. It was then that I realized that this is the wrong tool for the job. I need to syslog the lan traffic in real time, not wait for the transaction to complete so that it will show up in the fortilog. Of course that is somewhat of a rare occurrence, but it is still a lesson learned for me. Your suggestion is a good one though. That would be a good quick and dirty tool for keeping tabs on things.