How to find users abusing bandwidth?(pix firewall)

There isn't a more direct way, at least not with PIX 6. (I'm not familiar enough with PIX 7.)

There isn't really a lot of variety to choose from for PIX event analysis. I had to write my own analysis software. There used to be a commercial product, but it wasn't fast enough or flexible enough for my needs... and now that product is no longer available anyhow.

I supplied a simple perl program that might be good -enough- for your purposes; see

When we find out network is crawling I hook up the Ethernet cable from the Router that connects to the internet to a old style HUB (not a switch) and then a PC and the rest of the network on the Same HUB, then on the PC run a IP Packet grabber on it. We use EtherPeek from WildPackets. It will show you traffic and show you who is the biggest bandwidth or packet hog. EtherPeek is great with all its charts and graphs, though you can run MS's Network Monitor to look at the Traffic. You have to click the enable conversations on the start page. I have not found a way to give Conversation stats. Just shows you the Packets. If there is just one person generating the Traffic, (in our case there was someone streaming video) it would be pretty obvious.

ScottI have a pix firewall(515 I believe) and every day at lunch and again