In our context (and in the limited scope of which I was speaking, looking for sudden spikes in BW consumption) yes user=IP.
I'll look at writing a Lua script. Thanks for the direction. Cheers, Toby On Aug 7, 2013, at 9:55 AM, Luca Deri <[email protected]> wrote: > Toby > is the equation user=IP valid? > > The simple solution to your question is to write a small Lua script that > looks at the saved RRDs and computes the top X over the last Y > hours/days/weeks. The recent past is in memory instead so sorting hosts per > data moved should be enough > > Regards Luca > > On Aug 6, 2013, at 5:05 PM, Toby Simmons <[email protected]> wrote: > >> What is the best way to find a sudden high-bandwidth user? >> >> In our environment, if NTOP has run for several days, our servers will be >> the top bandwidth consumers by far (if you go to the Host List) but what is >> the best way to find, for example, one user whose usage in the last hour has >> exceeded everything else? >> >> Basically, is there a way to get a bandwidth report for the last 5 minutes >> or 2 hours, looking for top senders and top receivers, etc.? >> >> Thanks & >> Cheers, >> >> Toby >> >> _______________________________________________ >> Ntop-dev mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-dev > > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
