Bandwidth Utilization

Do you know how much bandwidth you have available? Do you monitor bandwidth utilization at your Internet gateways? We see many organizations experience weeks or months of strange network behavior, such as periods of packet loss and severe latency, only to find out the T1 to the Internet is running at nearly 100 percent capacity during business hours. In many cases, administrators aren't monitoring, and in some cases, they don't know how to monitor. If you are not monitoring bandwidth on your Internet circuits, you probably do not have a policy regarding when to upgrade to higher speed circuits either.

Monitoring bandwidth is usually straightforward, and a plethora of both commercial and open source tools are available to accomplish the task. If you happen to run commercial tools such as HP Open View, CA Unicenter, Cisco Works, or SolarWinds, these tools have the capabilities you need to effectively monitor bandwidth on your Internet circuits. The following list enumerates open source network management tools that enable bandwidth monitoring for network devices:

Package	Web Site
Multi-Router Traffic Grapher (MRTG): SNMP-based router/switch monitoring	http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
Network TOP (NTOP): Network sniffer-like tool to monitor network statistics	http://www.ntop.org
Nagios: Extensible network management package	http://www.nagios.com
Large listing of both commercial and open source tools	http://www.slac. stanford /xorg/nmtf/nmtf-tools.html

Once you have installed and configured the tool for monitoring, you need to collect statistics for at least one week, and preferably three to four weeks, in order to build a baseline utilization graph. Over time, you will begin to see what the peak usage patterns are for your gateway(s). In fact, you may start to notice anomalies such as SYN flood attacks or other types of network flooding attacks. These will become more apparent as you begin to recognize what the normal utilization patterns are for your network.

Once you have a baseline, you need to analyze the rate of change in utilization over time. Next, you need to consider your business requirements and goals to determine an acceptable usage threshold that requires you to increase available bandwidth. The baseline usage, in addition to the rate of change in utilization, will largely determine the specific threshold at which you need to increase bandwidth.

Generally, the only impact that attackers have on available bandwidth is by flooding or denial-of-service attacks. The network-monitoring tool you choose can help identify these types of attacks, in conjunction with intrusion detection systems (IDS), which we discuss in Chapter 7.