> -----Original Message----- > From: Bigelow, Andrea L. [mailto:[EMAIL PROTECTED] > Sent: Thursday, June 03, 2004 3:07 PM > To: '[EMAIL PROTECTED]'; MRTG (E-mail) > Subject: [mrtg] Re: Network Bandwidth > > > Deb, > > If your boss is looking for DOS attacks, those will be > painfully obvious on MRTG.
One thing you may be interested in is monitoring packets per second across your links. Sometimes a virus/worm infection will send a ton of small packets that don't amount to much actual bandwidth, but you will see huge swings in the number of packets. > What I'm saying is that you need to establish not just what > is average, but what falls within normal ranges. To do that. > go back through your archived information and look at your > weekly and monthly averages, and draw a few data points from that. > > I wish I could help you more on this. Every link on every > network has slightly different norm ranges -- some may have a > small range and a high average, others may have a small > average and a huge range. The latter is common if your Exactly. There isn't a cookie-cutter (that I know of) for this. Your choices are to do as Andrea suggests and guesstimate a sane threshold trigger for each link based on past trends for that particular link, or get as fancy as you can/want with scripting and comparing the values with previous values at the same time of day/day of week, etc.. and base your triggers on that. There's just not a canned slam-dunk solution with MRTG that I know of. I think OpenView may have tools along those lines, but that's a completely different animal. Good Luck, Tim -- Unsubscribe mailto:[EMAIL PROTECTED] Archive http://www.ee.ethz.ch/~slist/mrtg FAQ http://faq.mrtg.org Homepage http://www.mrtg.org WebAdmin http://www.ee.ethz.ch/~slist/lsg2.cgi
