Toby is the equation user=IP valid? The simple solution to your question is to write a small Lua script that looks at the saved RRDs and computes the top X over the last Y hours/days/weeks. The recent past is in memory instead so sorting hosts per data moved should be enough
Regards Luca On Aug 6, 2013, at 5:05 PM, Toby Simmons <[email protected]> wrote: > What is the best way to find a sudden high-bandwidth user? > > In our environment, if NTOP has run for several days, our servers will be the > top bandwidth consumers by far (if you go to the Host List) but what is the > best way to find, for example, one user whose usage in the last hour has > exceeded everything else? > > Basically, is there a way to get a bandwidth report for the last 5 minutes or > 2 hours, looking for top senders and top receivers, etc.? > > Thanks & > Cheers, > > Toby > > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
