Sorry for the long post. Also sorry if its a bit jumbled - my brain dumps are never coherent. We can try and edit it based on questions (if there even any) in due course.
Begin with the end in mind. You want to monitor bandwidth. This reply is focused on that goal.
Since most networks these days are ‘connected’ via switches, bandwidth is going to be something we need to look at per network drop and then use some software to total everything up (if and only if total bandwidth is the goal. Just knowing what each drop is can be valuable, enlightening and adequate in and of itself often).
You could, as zhhpei said, use Wireshark, but that is simply the wrong tool for the job. It is fantastic at ‘deep packet inspection’, but to use it to count total traffic over time would be uncomfortable. Also, you would need to install a hub at each drop to allow Wireshark to see the traffic on that drop.
Safe to say, Wireshark is not the right tool for the job in this case.
SNMP.
Simple Network Management Protocol.
This is the right tool for the job. It has been around a lot of years, is a bit of a standard, and works on Windows, Linux and PAC-Controllers.
While you can do parts of it by hand, or through OptoScript, there are better ways… That said, Mary has a great post on SNMP Traps, which we are not going to cover here, but I do highly suggest that you go read it.
The best bet is to use some SNMP monitoring software. There are Open Source, free and paid options. Google will guide you. (I have tried Cacti, Nagios, Zabbix, Ntop and The Dude). Look closely at the features, look at the amount of hosts the free versions support, look closely if the free version shows ads on the reports etc etc.
In the end, you just have to pick one and stick with it (wort’s and all). The longer you work with it, the better you will get at working around any short comings it has. One feature I would look at it is reports and alerting features. None of us have time to sit and watch the watcher, we simply want daily/weekly reports and an email the moment anything goes awry.
I chose ‘The Dude’ from Mikrotik. We have been using it on and off for years. I like the mapping feature. Its not open source, but it is free.
One major gotcha with this application. They no longer are developing the Windows server. They are only developing their routerOS version.
Not all the features of the Windows platform has made it over onto the RouterOS version yet, so its sort of in a no mans land at the moment.
I am happy with the features and bugs on the Windows version, so I am mostly using that, but I have purchased their minimum level router (Mikrotik hEX RB750Gr3) to run it on.
Here is an auto generated map of my lab generated by The Dude.
I am a very graphic/visual guy, so really like The Dude for this reason. Most of my interaction is through this map.
Double or right click on each object (I don’t mean to ‘sell’ The Dude, most SNMP applications are the same, so just bare with me) to expose the features of each device.
Green is all services up (you can add services like port 2001 and 22001 for Opto 22 devices), orange is one or more services are down and red is all services down.
On the links you can see some data, these are the current bandwidth values for that device to that port on the switch.
Hovering over them shows a graph.
This is for an OptoEMU-SNR-3v. It monitors the lab power. You can see that it is uploading power readings (the blue spikes) and is receiving a lot of broadcast packets and data addressed to it.
So how did we get here?
The main advantage of the SNMP software is that makes the SNMP tree structure a lot LOT simpler to work with.
Most Ethernet interfaces have some SNMP stack built in, so at the very least, to get SNMP up and running on your hardware, it should just take a software package to install.
As I said in my last post, we are using a few different managed switches. The brand does not seem to matter, more that they support SNMP and have a management console, either command line or web page interface.
Here is a screen shot of the TP-Link;
This is one of the smaller 8 port, but the 24 port and 48 port look almost the same.
The important part here is that under ‘Global Config’ you turn on SNMP and then under ‘SNMP Community’ you add a community name.
To check what it is in your Opto 22 devices, open PAC Manager, inspect the device, click on communications and then SNMP;
Thoughts about this. IT guys might like to change the community name so that it is a little more secure. You can also set up a user/password for the SNMP user/community/group. I recommend that you adhere to any of their recommendations. That said, for my lab, I set it to read-only and left the default group and community name as ‘public’ and no user/pass.
One of the reasons for this is that I wanted The Dude to be able to do a scan (discover) of the network and did not want to have to set up each device or several profiles for the SNMP user. Something to consider given the size of your network. If you have a few devices, you might make those changes (use PAC Manager to do it for Opto devices).
Note that some switches will allow you to monitor SNMP areas (called OID’s - Thanks @philip for that link, its very very useful). I don’t recommend that method. It only monitors one OID and it has no way of doing math on that value.
Once you have your SNMP client enabled and your SNMP community name saved, you can then unleash your software to scan the network and walk the SNMP tree.
Here is a small section of an Opto SNMP tree screenshot;
I have closed a lot of the tree folders, they go on and on and on and on and on.
You can drill your way into any leaf of the tree and look at just that OID data. Thankfully a lot of the SNMP software knows the tree structure (as I said, its a lose standard) and will pick the right parts for automatically saving a HUGE amount of time.
Here is the Incoming OID that @philip posted; 1.3.6.1.2.1.2.2.1.10.2
Here is how it looks in the tree;
So now you can start to see the real value of the software for two reasons.
1. I did not have to look anything up, I just had to tell the software that I wanted to use port 2
On opto devices, you can see that port 1 is loopback, port 2 is Eth0 and that is the one I am connected to.
2. The software takes that accumulated value and divides it over time and BOOM! there is your bandwidth. (In a nice graph).
MIB
A quick word on MIB’s.
MIB’s or Management Information Base work hand in hand with SNMP.
MIB describes vendor specific sections of the SNMP tree that are not in the standard.
Here is the front of the Opto 22 MIB;
As you can see, they are all things that are unique to Opto 22.
Most managed switch vendors do the same thing, the SNMP standard takes care of all the interface data in/out counters etc, but they might add CPU use or CPU temperature, Fan status/RPM and things like that… You will find those OID’s in their MIB.
Most network management software allows you to add MIB’s as needed.
So, to summarize.
SNMP is a rough standard.
OID’s are a rough standard.
Most network monitoring software knows about those standards and so can pick good values to give you the most bang for your buck (and time) out of the box.
What about PAC Display on a Windows PC?
Yes, Windows PC have SNMP, but its not turned on.
To enable SNMP on a Windows 10 pc, click on the start button and type in ‘turn windows features on or off’
From there, check the SNMP feature on. Wait a moment for it to load.
Once that is done, you need to add the SNMP community, to do that, click on Start and type in ‘services.msc’.
Once that opens, drill your way down to SNMP
Double click on it.
From there, click on the Security Tab and add the community public (or what ever you ended up calling yours);
Add it to the list, IMPORTANT, make sure to change the dot from Accept SNMP packets from these hosts and Accept SNMP packets from any host… and then click Ok out of all the dialog boxes.
Now you have SNMP enabled on that PC (open the firewall for port 161 UDP if you need to).
You can now point your network management software at that IP address and get the bandwidth data for PAC Display (and every other application running on that PC over the network).
What about using Node-RED?
Install the SNMP nodes.
Set them up something like this;
You need an inject node to say how often you want to read the OID. Sorry, no nice tree view here, you have to know the exact OID you want.
Then push it to either a PAC Controller (useful for using a timer to work out rate rather than just amount - depends on what your OID is returning) or a groov Data Store (as I have done in lower version of this flow).
Phew. We made it.
tl;dr
- Get managed switches, turn on SNMP.
- Enable SNMP on your Windows PC.
- Configure your SNMP community in all devices (or leave it as the default public).
- Pick some network monitoring software. Download it, install it, unleash it on your network.
- Profit.