The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
Network Monitoring Apps?
SeñorAmor
!!!Registered User regular
!!!Registered User regular
A client of mine has several apartment complexes. To attract tenants, he is offering free high-speed internet to all apartments. To save money, he has one internet connection that is then distributed to all his buildings (they are quite close to each other), and from there to each apartment.
The current setup is like so:
The main building -- where the internet feed is -- houses a simple Linux server running a basic firewall and DHCP and DNS servers. From there we route to a switch and from that switch, to switches in each of the other buildings, and finally from those switches to each apartment (each apartment has a single jack and it is up to the tenant to distribute it from there, if they so wish).
My client, being thrifty as all landlords are, opted to go with the bottom of the line switches (ie - no managing whatsoever), and mediocre hardware in his server. He is now having issues with tenants downloading illegal files and the ISP is threatening to terminate service unless this can be stopped.
I am looking for some software that runs under Linux (preferably) that can actively monitor and log people doing stuff they shouldn't be. It'd be nice to be able to check the logs and see someone using massive amounts of bandwidth. It'd be even nicer if it did some packet sniffing and was able to tell me what they were down/uploading. I'm thinking perhaps it could show IP address and maybe computer name, or something along those lines.
I'm sure something like this exists, but my Google-fu is weak and I cannot find what I'm looking for. Any suggestions, folks? Thanks in advance.
The current setup is like so:
The main building -- where the internet feed is -- houses a simple Linux server running a basic firewall and DHCP and DNS servers. From there we route to a switch and from that switch, to switches in each of the other buildings, and finally from those switches to each apartment (each apartment has a single jack and it is up to the tenant to distribute it from there, if they so wish).
My client, being thrifty as all landlords are, opted to go with the bottom of the line switches (ie - no managing whatsoever), and mediocre hardware in his server. He is now having issues with tenants downloading illegal files and the ISP is threatening to terminate service unless this can be stopped.
I am looking for some software that runs under Linux (preferably) that can actively monitor and log people doing stuff they shouldn't be. It'd be nice to be able to check the logs and see someone using massive amounts of bandwidth. It'd be even nicer if it did some packet sniffing and was able to tell me what they were down/uploading. I'm thinking perhaps it could show IP address and maybe computer name, or something along those lines.
I'm sure something like this exists, but my Google-fu is weak and I cannot find what I'm looking for. Any suggestions, folks? Thanks in advance.
SeñorAmor on
0
Posts
My google-fu is strong but my network administration is weak. Try googling "Linux network monitor," although you might have to look a little deeper to find something that lets you monitor traffic and then shape/block stuff. I would imagine you'd want to block certain ports/apps and give each tenant a set bandwidth amount.
Alternatively, you could limit destination ports at the firewall to common services. If they want the full interwebs then they can pay the full price for their own connection.
There is also a command line "live view" tool called iftop that I like to use to see exactly who is doing what right now.
Im also a big fan of IPCOP. Its an excellent linux based firewall/proxy server. There's lots of addon's and stuff. If you install something like the L7 blocker addon, you could block P2P or torrent traffic through the firewall. I think there is even one for it that can be used for billing based on bandwidth usage. And its all free. Could possible replace the current firewall with it and at least gain some manageability you might not have.
Its really hard to do individual monitoring without managed switches. Even if you had one managed switch in the central building, you could at least monitor the ports on that, and find out which building is using the most traffic with something like MRTG or cacti.
And he's using one connection for multiple buildings? I sure hope his ISP doesn't have a bandwidth cap of any sorts or he's going to pay dearly.
Technically, if he is providing the service for free, he can probably do whatever he wants with the connection. Have a lawyer draw up a quick document saying that your internet browsing can be observed and recorded, and if you don't like it, you don't get free internet.
t SunDragon good call on the IPCop.
Laws typically don't differentiate between free and not free. For instance, free healthcare doesn't mean that the medical institution providing the service doesn't have to follow HIPAA regulations. IANAL, but it's really important for the landlord to contact a lawyer and ask what is legal and what is not in this situation. Both he and the OP could wind up in a heap of trouble.
Yeah, taking away the renter's right to privacy would make the whole legal issue a moot point.
What kind of service is he getting from his ISP? Your friend is essentially operating as a reseller by taking on connection and sharing it out to multiple private parties. I think he'd need some kind of reseller's agreement with his provider in order to protect himself. Especially if he's concerned about what his tennants are downloading. What if one of his tennants downloads kiddie porn using this shared connection? Is he liable for that tennant's activity? Would he be able to claim protection from liability via the DCMA Safe Harbor provisions, i.e. by claiming that he's a service provider and thus not responsible for the things his users (tennants) choose to do with the connection? IANAL, so I can't answer these questions. These are things he should be asking a lawyer, though, and he would be a lot better off asking them now than at some crisis point in the future.
I don't see this as being a technical issue at all. If he just wants the connection to work well for all involved, all he needs to do is configure QoS on the link so that all traffic is considered bulk except for those protocols that are considered non-bulk traffic (e.g. HTTP, VOIP, etc.). The real issues here are legal ones, and it makes no sense to try to apply technical solutions to a legal problem. Even if there's no liability issue here in terms of what his tennants do with the connection, he stills needs legal advice in terms of coming to some agreement with his ISP, such that he can continue to share the connection they provide without causing the ISP to threaten disconnection.
That's kind of like saying (Super Interwebs Analogy!) he's allowed to put cameras in his restrooms, so long as they're free to use.
There are privacy issues here. I wouldn't doubt he'd only be able to monitor raw bandwidth numbers.
ISPs can terminate you or anyone at any time for pretty much any reason they want. It's their service that they are providing and if they want to refuse money then they can certainly do so. They can't terminate your service and then charge you some sort of earlier termination fee.