Amos, Of course if you purely want to find out the "top talkers" by IP, probably the "industry-standard" of way of doing is to in the longer term is to have your router send netflow stats to a collection server. Pretty much any business level router will do this. And if you have chosen a Linksys WRT type of router you run DD-WRT or OpenWRT on it and it will also have a netflow (or a clone, DD-WRT uses "rflowd"). Netflow stats can then be captured and processed with flow-tools (for scrit based processing) or Ntop which gives a more graphical way of viewing things.
The custom WRT firmware can also run tcpdump which can be used for detailed analysis by Wireshark. So depending on your choice of routers you may not even need a hub or port-mirroring switch. Regards, Martin martinvisse...@gmail.com -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
