1. OAUNETMON: A Network Traffic Monitoring Tool Olatunde Abiona Lecturer/Computer Engineer Department of Computer Science & Engineering Obafemi Awolowo University, Ile-Ife, NIGERIA

2. World Map World Map ©1996 MAGELLAN Geographix Santa Barbara, CA (800) 929-4MAP

3. Africa Africa

4. Nigeria Nigeria Ile-Ife

5. Obafemi Awolowo University, Ile-Ife Oduduwa Hall

6. Obafemi Awolowo University, Ile-Ife College of Health Sciences building

7. Obafemi Awolowo University, Ile-Ife Computer Science & Engineering Dept.

8. Outline of the Presentation Introduction Introduction The Obafemi Awolowo University Network (OAUNet). The Obafemi Awolowo University Network (OAUNet). Design/Architecture of OAUNETMON. Design/Architecture of OAUNETMON. Some screen shots of OAUNETMON. Some screen shots of OAUNETMON. Conclusions Conclusions

9. The Obafemi Awolowo University Ile-Ife, Nigeria 250km North-East of Lagos 250km North-East of Lagos 20,000 students, 13 faculties and 2 colleges 20,000 students, 13 faculties and 2 colleges Campus network: TCP/IP protocol and LINUX operating system. Campus network: TCP/IP protocol and LINUX operating system. Wireless spread spectrum radio technique for linking buildings Wireless spread spectrum radio technique for linking buildings Over 600 individual account users, within a year of operation. Over 600 individual account users, within a year of operation. Capacity building component provided critical mass of competent Technical Staff Capacity building component provided critical mass of competent Technical Staff

10. The Obafemi Awolowo University. Network (OAUNet). Was born out of a collaboration between International Centre for Theoretical Physics (ICTP), Trieste Italy and Obafemi Awolowo University (OAU) Ile-Ife Nigeria (1996). Was born out of a collaboration between International Centre for Theoretical Physics (ICTP), Trieste Italy and Obafemi Awolowo University (OAU) Ile-Ife Nigeria (1996). Started with 3 subnets now over 14 subnets and 9 cyber cafes. Started with 3 subnets now over 14 subnets and 9 cyber cafes. Full Internet connectivity ie 256 Kbps Uplink and 512 Kbps Downlink bustable to 1Mbps. Full Internet connectivity ie 256 Kbps Uplink and 512 Kbps Downlink bustable to 1Mbps.

11. OAUNET - Main Network Diagram Main HUB sctechcs usbchsagric NC First Generation Second Generation Third Generation Key sc - sciences tech - Technology cs - Computer Science usb - Secretariat chs - Health Science Agric- Agriculture NC - NACTEM OA - OAU Teaching hospital OS Fourth Generation AP 2Mbps VSAT Earth Station 64 Kbps Dial up MODEM 33 Kbps OS C C Fifth Generation OS CCC

12. Main HUB or network Firewall Proxy Mail Server Modem Server Backup Server Inter Subnet Router WLAN Antenna WEB Server Terminal Equipment CISCO router 100 base Tx Ethernet Backbone Pentium IV PCs

13. Architecture of Most Subnets Subnet Server (UNIF II) INTEL Pentium CPU Powered by Linux Local DHCP Server Local NIS Server Local DNS Server Local Telnet Server Campus Wide NFS Static Router Masquerading and IP forwarding WaveLan cards SWITCH One or more client computers Running Windows or Linux + KDE Provide Print services, and telnet clients Auto- configured through DHCP Ethernet Antenna SA 2 Mbps link to Main network

14. The original design of the LAN to INTERNET link

15. OAUNETMON Setup

16. Features of OAUNETMON Non-Intrusive Network Monitoring system. Non-Intrusive Network Monitoring system. Web-based network monitor and analysis system Web-based network monitor and analysis system Capable of Handling Large log files Capable of Handling Large log files Capable of monitoring Fast Ethernet or switched network. Capable of monitoring Fast Ethernet or switched network. Capable of analyzing Proxy logs (squid access log flies) Capable of analyzing Proxy logs (squid access log flies)

17. Design Consideration Powerful user interface – web interface Powerful user interface – web interface Guaranteed packet capturing – uses gigabit interface for data capture Guaranteed packet capturing – uses gigabit interface for data capture Classification of all protocol information – ability to classify and display all possible protocol in each layer Classification of all protocol information – ability to classify and display all possible protocol in each layer Security – Access are restricted only to those with valid username and password. Security – Access are restricted only to those with valid username and password. Viewing of real-time and historical data – shows online real-time status data and accumulated historical status data easily Viewing of real-time and historical data – shows online real-time status data and accumulated historical status data easily

18. Equipment required for the setting up OAUNETMON Pentium iv 2.0Ghz CPU Pentium iv 2.0Ghz CPU 1.0GB Ram, 80.0GB HDD 1.0GB Ram, 80.0GB HDD FDD, CD Writer 40X FDD, CD Writer 40X 1Gigabit Ethernet Switch (D-link DES- 3226L) 1Gigabit Ethernet Switch (D-link DES- 3226L) 1Gigabit Network interface card 1Gigabit Network interface card 700VA UPS 700VA UPS Linux Operating System ( Mandrake 10.1) Linux Operating System ( Mandrake 10.1)

19. Architecture of OAUNETMON

20. Perl wrapper script

21. Routine Run_MRTG

22. Routine Run_Webalizer

25. Daily Graph

26. Weekly and Monthly Graph

27. Hosts Listing

28. Host Usage Graph

29. Hosts Usage Cont…

30. Protocol Listing

31. Protocol Usage Graph

32. Protocol Usage Cont…

33. Webalizer

34. Webalizer

35. Daily Usage

36. Hourly Usage

37. KB transferred

38. Proxy Log Analysis OAUNETMON also carryout proxy log analysis on squid access log OAUNETMON also carryout proxy log analysis on squid access log

39. Some Bandwidth optimization Technique CBQ CBQ HTB HTB Mirroring Mirroring Firewall Firewall –Filtering Deny, Reject, Redirect …based on firewall rules Deny, Reject, Redirect …based on firewall rules SQUID SQUID –Web caching –Access control list –Authentication –Delay pools it is possible to limit internet traffic in a reasonable way depending on so- called 'magic words', existing in any given URL For example, a magic word could be '.mp3', '.exe' or '.avi', etc.

40. OAUNETMON Installation Install linux Install linux –/tmon –/logf Install Mrtg Install Mrtg Install Webalizer Install Webalizer Iptraf Iptraf Install Apache Install Apache Replace your back bone switch with a Gigabit Switch that can support Port mirroring Replace your back bone switch with a Gigabit Switch that can support Port mirroring Download all files from Download all files from –http://www.ictp.it/~abionao/tunde http://www.ictp.it/~abionao/tunde To appropriate directories Restart your computer! Restart your computer!

41. OAUNETMON DEMO http://82.206.239.38/oaunetmon/ http://82.206.239.38/oaunetmon/ http://82.206.239.38/oaunetmon/

42. Conclusion Experimental design goals such as extracting highly detailed information without adversely affecting network performance (speed) is archived through a process of extracting the required information from IP packet without considering the contents. The scripts are available at http://www.ictp.it/~abionao. Experimental design goals such as extracting highly detailed information without adversely affecting network performance (speed) is archived through a process of extracting the required information from IP packet without considering the contents. The scripts are available at http://www.ictp.it/~abionao.http://www.ictp.it/~abionao

43. Acknowledgement We wish to acknowledge the support of the Abdus Salam International Centre for Theoretical Physics (ICTP) for the donation of the equipment used for this study. We wish to acknowledge the support of the Abdus Salam International Centre for Theoretical Physics (ICTP) for the donation of the equipment used for this study.

44. THANK YOU