[mrtg] Re: Network Bandwidth

[Tim Sheets]

> -----Original Message-----
> From: Bigelow, Andrea L. [mailto:BigelowA at SEC.GOV]
> Sent: Thursday, June 03, 2004 3:07 PM
> To: 'Deb.Brackman at crown.com'; MRTG (E-mail)
> Subject: [mrtg] Re: Network Bandwidth
> 
> 
> Deb,
> 
> If your boss is looking for DOS attacks, those will be
> painfully obvious on MRTG. 

One thing you may be interested in is monitoring packets per second
across your links.  Sometimes a virus/worm infection will send a ton of
small packets that don't amount to much actual bandwidth, but you will
see huge swings in the number of packets.



> What I'm saying is that you need to establish not just what
> is average, but what falls within normal ranges. To do that. 
> go back through your archived information and look at your 
> weekly and monthly averages, and draw a few data points from that. 

> 
> I wish I could help you more on this. Every link on every
> network has slightly different norm ranges -- some may have a 
> small range and a high average, others may have a small 
> average and a huge range. The latter is common if your 

Exactly.  There isn't a cookie-cutter (that I know of) for this.  Your
choices are to do as Andrea suggests and guesstimate a sane threshold
trigger for each link based on past trends for that particular link, or
get as fancy as you can/want with scripting and comparing the values
with previous values at the same time of day/day of week, etc.. and base
your triggers on that.  There's just not a canned slam-dunk solution
with MRTG that I know of.  I think OpenView may have tools along those
lines, but that's a completely different animal.

Good Luck,

Tim

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi