Hi everyone,
I work for an organization which is paying $$$$ for their WAN internet connection. It would be beneficial to generate a report to show the org what their actual usage is. My needs:
- Peak usage, in megabits/sec
- Avg usage, preferably with an interval that can be defined, eg: avg usage over 24 hours, avg over 5 days, etc
- Be able to specify a start/end date for report to evaluate historical figures
- Identify the src or dest. hostname, IP, or OPNSense interface, to categorize and include/exclude them from the report
This report would help us determine if we're overutilizing/underutilizing the WAN connection, on what dates, by which devices, and their use case.
I've evaluated the following that's native to OPNSense:
Reporting > Traffic - This shows data only in real time. There's no reporting option available to look at historical metrics.
Reporting > Insight - This covers most of my asks, but the biggest downside is that the .csv reports it generates does not show speed in terms of bytes, but in packets. The 'Details' tab in the web GUI shows bytes, but it's bandwidth usage, not bandwidth speed.
VnStat plugin - This shows bandwidth speed. I can see HH/DD/MM/YY stats, which is awesome. I can't specify exact dates/times, which is fine. The drawback is it doesn't list the hostname/IP of that traffic, so I don't know what is consuming the data.
I *think* there's no perfect option that meets my needs, and I'm left to just take all the various reports and try to generate my own report manually. I hope I'm wrong and someone here can suggest something that can answer my needs?
Thank you very much for your time.
Peak, average, selection of time frame can all be done with an SNMP based network management system (NMS) like LibreNMS (https://www.librenms.org) or Observium (https://www.observium.org). I prefer Observium.
You need a separate machine or VM inside your network to run this software.
They (Observium) have complete guides for installation on Debian/Ubuntu (https://docs.observium.org/install_debian/) and I wrote an equivalent complete guide for installation on FreeBSD (https://github.com/pmhausen/observium-freebsd-install).
The last point in your requirements list needs some bigger guns, e.g. ElastiFlow (https://www.elastiflow.com). Resource requirements are way heavier than for an NMS but you get more detailed traffic/volume reports so pick your poison. Heavier means 16 GB of memory and according to their docs 8 cores for the VM. Plus a couple of hundred of GB of virtual disk drive. I run it smoothly with 16 GB (no way around that, because "Elasticsearch") and 4 cores plus 300 GB of virtual disk.
They have a free "basic" license for up to 4000 flows (think "connections") per second - which is quite a bit so it fits probably every home lab and many smaller companies.
They have a nice quickstart guide for Ubuntu (https://www.elastiflow.com/docs/flowcoll/install_docker_ubuntu_elastic_stack).
You might even want to deploy both, because an NMS not only gives you traffic measurements but also hardware stats like CPU, memory, disk, temperatures etc.
HTH,
Patrick