How to track the return of traffic in the organization?

Question

Computer networks

Tell me how you can track the return of traffic in the office, the problem is that the channel for return is clogged and it is impossible to connect to the server remotely via the Internet, or does it throw it out of the session, is it quietly connected to the server on the local network?
Network structure
There is a TP Link router in it and the Internet
and Dlink switches come in
about 20 computers and 1 server RDP connection,
so I want to see from which IP there is such a big return almost around the clock in waves
, so I want to know what methods of verification are there? Can you see the program or do you need to put something in front of the router and write logs on it?
or maybe it’s not about the recoil at all.
The provider said that the recoil channel is completely clogged even at night

Answer 1

The router needs a human one who can netflow or the like. At worst, at least port mirroring. Well, analyze.

Answer 2

You should get port statistics from Dlink through the management / administration interface and you will see it right there.

Answer 3

I can only look at the TP link to see the total given is transferred, so far in the router I have limited the return to the minimum for everyone, but this is a temporary solution, so far only thoughts that would allow maximum return on 1 IP and so on until I find whose IP clogs the channel

Answer 4

Always in those cases when you distribute Internet to users directly through NAT, you come to such situations. In your case, the easiest way is to make a virtual machine with a proxy, release users through it. And direct access to the Internet to cover. On a proxy, it is easier to analyze and limit, and as soon as you turn it on, the problem will disappear.

Answer 5

There are ntop and other network traffic analyzers.

Answer 6

Look at alternative firmware for your router, for example openwrt. It shows the speed of the clients.

Answer 7

So you just track it down or fight it?
If you fight, then set Mikrotik and limit the number of active connections for each IP, as well as speeds. We put mikrotiki and it really helps.