2

I have a 100 Mbit WAN connection and want to check the load on it for a week.

So I put a hub (10/100Mbit) behind the WAN connection and connected a laptop with wireshark on it. Here is now my question - can i print a report or graph with the dump i create? How can i do this? Or can i put the wireshark in a special measure mode ;-) so it doesnt capture the whole packages and just read the load?

Thank you very much in advance!

Fake4d
  • 603
  • 7
  • 10
  • 16

4 Answers4

5

Don't use wireshark, you're getting way too much detail (unless you need that detail). Enable SNMP on the WAN device and use MRTG or cacti to get a graph of the traffic. If the WAN device doesn't support SNMP, then by all means use the hub and the laptop to get to the data. If you are unsure on how to use MRTG, put a comment here and I'll provide more detail.

wolfgangsz
  • 8,847
  • 3
  • 30
  • 34
2

Wireshark is really intended to inspect individual packets and re-construct a specific protocol's network flow. It's not really the best tool to measure load.

Something like ntop, cacti or MRTG would probably server you better, but without knowing the specific requirements of your environment I can't make any better suggestions.

1

I'd agree with @kce and @wolfgangsz that wireshark isn't the best tool for the job, but as you've already got the data then I'd suggest looking at the wiki page for Wireshark and picking one of the tools from there. TTT might do what you need it to.

Matthew Steeples
  • 1,303
  • 1
  • 10
  • 17
1

As others have stated in their answers, Wireshark is not really the tool for the job. While you certainly can monitor all traffic flows with Wireshark you'll be stuck reconstructing all of those flows to get any type of aggregate usage data. A better tool would be PRTG ot MRTG.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172