OAUNETMON: A Network Traffic Monitoring Tool Olatunde Abiona Lecturer/Computer Engineer Department of Computer Science & Engineering Obafemi Awolowo University, Ile-Ife, NIGERIA

World Map World Map ©1996 MAGELLAN Geographix Santa Barbara, CA (800) 929-4MAP

Africa Africa

Nigeria Nigeria Ile-Ife

Obafemi Awolowo University, Ile-Ife Oduduwa Hall

Obafemi Awolowo University, Ile-Ife College of Health Sciences building

Obafemi Awolowo University, Ile-Ife Computer Science & Engineering Dept.

Outline of the Presentation Introduction Introduction The Obafemi Awolowo University Network (OAUNet). The Obafemi Awolowo University Network (OAUNet). Design/Architecture of OAUNETMON. Design/Architecture of OAUNETMON. Some screen shots of OAUNETMON. Some screen shots of OAUNETMON. Conclusions Conclusions

The Obafemi Awolowo University Ile-Ife, Nigeria 250km North-East of Lagos 250km North-East of Lagos 20,000 students, 13 faculties and 2 colleges 20,000 students, 13 faculties and 2 colleges Campus network: TCP/IP protocol and LINUX operating system. Campus network: TCP/IP protocol and LINUX operating system. Wireless spread spectrum radio technique for linking buildings Wireless spread spectrum radio technique for linking buildings Over 600 individual account users, within a year of operation. Over 600 individual account users, within a year of operation. Capacity building component provided critical mass of competent Technical Staff Capacity building component provided critical mass of competent Technical Staff

The Obafemi Awolowo University. Network (OAUNet). Was born out of a collaboration between International Centre for Theoretical Physics (ICTP), Trieste Italy and Obafemi Awolowo University (OAU) Ile-Ife Nigeria (1996). Was born out of a collaboration between International Centre for Theoretical Physics (ICTP), Trieste Italy and Obafemi Awolowo University (OAU) Ile-Ife Nigeria (1996). Started with 3 subnets now over 14 subnets and 9 cyber cafes. Started with 3 subnets now over 14 subnets and 9 cyber cafes. Full Internet connectivity ie 256 Kbps Uplink and 512 Kbps Downlink bustable to 1Mbps. Full Internet connectivity ie 256 Kbps Uplink and 512 Kbps Downlink bustable to 1Mbps.

OAUNET - Main Network Diagram Main HUB sctechcs usbchsagric NC First Generation Second Generation Third Generation Key sc - sciences tech - Technology cs - Computer Science usb - Secretariat chs - Health Science Agric- Agriculture NC - NACTEM OA - OAU Teaching hospital OS Fourth Generation AP 2Mbps VSAT Earth Station 64 Kbps Dial up MODEM 33 Kbps OS C C Fifth Generation OS CCC

Main HUB or network Firewall Proxy Mail Server Modem Server Backup Server Inter Subnet Router WLAN Antenna WEB Server Terminal Equipment CISCO router 100 base Tx Ethernet Backbone Pentium IV PCs

Architecture of Most Subnets Subnet Server (UNIF II) INTEL Pentium CPU Powered by Linux Local DHCP Server Local NIS Server Local DNS Server Local Telnet Server Campus Wide NFS Static Router Masquerading and IP forwarding WaveLan cards SWITCH One or more client computers Running Windows or Linux + KDE Provide Print services, and telnet clients Auto- configured through DHCP Ethernet Antenna SA 2 Mbps link to Main network

The original design of the LAN to INTERNET link

OAUNETMON Setup

Features of OAUNETMON Non-Intrusive Network Monitoring system. Non-Intrusive Network Monitoring system. Web-based network monitor and analysis system Web-based network monitor and analysis system Capable of Handling Large log files Capable of Handling Large log files Capable of monitoring Fast Ethernet or switched network. Capable of monitoring Fast Ethernet or switched network. Capable of analyzing Proxy logs (squid access log flies) Capable of analyzing Proxy logs (squid access log flies)

Design Consideration Powerful user interface – web interface Powerful user interface – web interface Guaranteed packet capturing – uses gigabit interface for data capture Guaranteed packet capturing – uses gigabit interface for data capture Classification of all protocol information – ability to classify and display all possible protocol in each layer Classification of all protocol information – ability to classify and display all possible protocol in each layer Security – Access are restricted only to those with valid username and password. Security – Access are restricted only to those with valid username and password. Viewing of real-time and historical data – shows online real-time status data and accumulated historical status data easily Viewing of real-time and historical data – shows online real-time status data and accumulated historical status data easily

Equipment required for the setting up OAUNETMON Pentium iv 2.0Ghz CPU Pentium iv 2.0Ghz CPU 1.0GB Ram, 80.0GB HDD 1.0GB Ram, 80.0GB HDD FDD, CD Writer 40X FDD, CD Writer 40X 1Gigabit Ethernet Switch (D-link DES- 3226L) 1Gigabit Ethernet Switch (D-link DES- 3226L) 1Gigabit Network interface card 1Gigabit Network interface card 700VA UPS 700VA UPS Linux Operating System ( Mandrake 10.1) Linux Operating System ( Mandrake 10.1)

Architecture of OAUNETMON

Perl wrapper script

Routine Run_MRTG

Routine Run_Webalizer

Daily Graph

Weekly and Monthly Graph

Hosts Listing

Host Usage Graph

Hosts Usage Cont…

Protocol Listing

Protocol Usage Graph

Protocol Usage Cont…

Webalizer

Webalizer

Daily Usage

Hourly Usage

KB transferred

Proxy Log Analysis OAUNETMON also carryout proxy log analysis on squid access log OAUNETMON also carryout proxy log analysis on squid access log

Some Bandwidth optimization Technique CBQ CBQ HTB HTB Mirroring Mirroring Firewall Firewall –Filtering Deny, Reject, Redirect …based on firewall rules Deny, Reject, Redirect …based on firewall rules SQUID SQUID –Web caching –Access control list –Authentication –Delay pools it is possible to limit internet traffic in a reasonable way depending on so- called 'magic words', existing in any given URL For example, a magic word could be '.mp3', '.exe' or '.avi', etc.

OAUNETMON Installation Install linux Install linux –/tmon –/logf Install Mrtg Install Mrtg Install Webalizer Install Webalizer Iptraf Iptraf Install Apache Install Apache Replace your back bone switch with a Gigabit Switch that can support Port mirroring Replace your back bone switch with a Gigabit Switch that can support Port mirroring Download all files from Download all files from – To appropriate directories Restart your computer! Restart your computer!

OAUNETMON DEMO

Conclusion Experimental design goals such as extracting highly detailed information without adversely affecting network performance (speed) is archived through a process of extracting the required information from IP packet without considering the contents. The scripts are available at Experimental design goals such as extracting highly detailed information without adversely affecting network performance (speed) is archived through a process of extracting the required information from IP packet without considering the contents. The scripts are available at

Acknowledgement We wish to acknowledge the support of the Abdus Salam International Centre for Theoretical Physics (ICTP) for the donation of the equipment used for this study. We wish to acknowledge the support of the Abdus Salam International Centre for Theoretical Physics (ICTP) for the donation of the equipment used for this study.

THANK YOU