[clue-tech] The Rogue Uploader

[David L. Anselmi]

David L. Willson wrote:
> My pipe runneth over...
> 
> I have a constant upload rate of 200Kb, which surges to 1.6Mb for long enough to make my
> users cranky.  Sometimes, I even have to power-cycle the router to calm things down. 
> Bleah...
> 
> As I understand it, I can put a hub with three lines in place of the line from my
> network to the router, and I can run the 3rd line to my Linux laptop in promiscuous
> mode, and then I will be able to audit all the Internet traffic to and from my network
> from my laptop.

When I've wanted stats like that I've used ntop, though not quite like 
you describe.  Have a look and if it doesn't do what you want easily 
enough I'll look for something else.

If you set up wireshark to capture everything on that interface (capture 
-> options; select interface, leave the filter blank) then you can look 
at its statistics page (you probably have to stop the capture to get 
there), see:

http://www.wireshark.org/docs/wsug_html_chunked/ChStatEndpoints.html

But the capture file will have every bit going across the network.  So 
don't do anything silly that will update your stats (like ssh into the 
laptop and display the wireshark window back across the network).

HTH,
Dave