monitor bandwidth in squid?
 

Is there anyway to monitor the current bandwidth in use by a user (NCSA auth) on squid?
Occasionally we get a user downloading too many videos at once, which blocks bandwidth to other users on the network. As I have no idea which user it is until the end of the day (SARG reports), we just restart the squid server to disconnect their downloads - not ideal.

I'd suggest giving iptraf, ntop, or vnstat a run.

Does iptraf run on the command line? It seems to have a GUI in all their manuals.

Got it.
Ok, so currently my eth0 is at 4038kbits/sec.
Seems reasonable.
So, I just plug this up when there's a problem, find the IP address.
Then I have to bring up the squid log and cross check the IP?

What is promiscuous mode? :)
Is there a way to log the actual total bandwidth per hour or 10mins perhaps by IP or does this have to be done through the logging? ...or do I turn logging on and then have to use a log reading tool for iptraf?

I lost the SSH link while IPTRAF was running.
Now when I try to go into detailed statistics it says: detailed interface stats alreday monitoring eth0.
How do I stop that so I can view it again?
I tried kill and the process id which I found using pidof iptraf but it won;t stop the program.

promiscuous mode, at least as it relates to network cards & is as much as I understand it, is a mode in which the card listens to all packets, not just those destined for the machine itself.

It is pretty much compulsory for a packet sniffing type of utility to use it, otherwise you'd be ignoring some of the traffic on the wire.

I would suggest running the application in 'screen' if you get disconnected then you can always reconnect to the screen.

screen (will go back to prompt)
ctrl a-d (will disconnect the screen returning you to original prompt)
screen -r (will resume an existing screen, may have to specify the pid)

I wrote a blog article about screen on our company blog a while back and I'm not going to c&p it here if you want more details on how screen works check out the blog.