Bandwidth used by unknown - please help

[PPJ]

I have an extremely basic little LAN in a semi commercial environment, and one of the connected machines or a laptop conecting by cable steal bandwidth. We can see by the useage graphs (our ISP is Web Africa) that the stealing is happening on a Sunday?? The access control wireless wise is reasonable but anyone with a (door) key can come and plug in via cable. The setup we have is very simple: A ADSL/wireless access point/router (in 1 box) that provide allways on internet (PPPoE) - so anyone that can plug in can surf (and download).

Now the plea for help:
We do not want anyone to know we are monitoring, so we cannot load monitoring software on individual PC's - also if the stealing PC is a roaming (unknown) pc we still wont catch the thief. For this part of the exercise, we can assume the stealing PC is either plugged in or connected "legaly" to the wireless - iow someone we know (and trust)!!!!

Is anyone aware of a method where we can establish for starters just the time/s the bandwidth is used on a Sunday (btw Sunday usage is not unusual)? Web africa just give total up and down load for the day?

Please point me at possible solutions that you may know about, or kindly make sugestions. If this question is utterly stupid, please also let me know:p

PPJ

[Sapphiron]

You need to have some form of gateway based PC. You can install untangle Firewall
Set it up in bridged mode and it will fit in between your ADSL and your LAN network, without affecting your existing configuration. Unfortunately, due to the fact that the wireless is on the router, nothing will measure traffic on that except if you install something on all the PC's in the network.

Untangle sends out daily reports on bandwidth usage. It will give you the bandwidth usage per IP address. The IP address you can cross reference with the PC's MAC address, or lookup the hostname using ping from the command line.

I'm in the Cape Town area, I do this sort of thing for a living, so if you are interested, give me a PM.

BTW untangle is free, it just needs a PC box with 2 lan cards

[.Froot.]

+1 on the above method. Not familiar with untangle, but rather with the popular Linux gateways...

[PPJ]

Thanks so far guys. The gateway way seems to be the way..... I will definitly look at untangle - do not know about it. I did used a gateway (captive portal - PublicIp) about 2 years ago) so I will have a suitable PC here some where. I also have enough building blocks to unbundle the router/ap/modem...... for the "investigation":D

I will get cracking on this thanks again Thanks also for the offer for PM help!!

[The_Librarian]

Any news so far?