Flying Tower Firewall is a good old product, support multi-line access, there are VPN, UTM and other functions.
At the same time its detection function is also very good, can achieve similar to the effect of sniff pro.
This article says, how to use the Flying Tower Firewall to view the specific traffic of an IP, and the corresponding IP of traffic.
Note: The picture of this article are large high-definition images, Firefox right click Select View pictures can see the image is not compressed, 360 browser needs to hold down the picture, drag, you can see the original large picture.
Generally for traffic after running full, we need to check which users are occupied by the traffic, operation in the Flying Tower Firewall, using Firefox browser to visit the tower Firewall, pay attention to see the flow of 40M flow interface (PORT5, we are multi-line access, so there are multiple extranet interface),
Main points: Must use Firefox access, IE has compatibility issues. Unable to display live traffic
Click on the red box above, you can see the current 1 hours of traffic detail. It is found from the figure that the flow is approaching the peak.
Back to look at the bottom of the two map, one is the use of bandwidth before the top 20 rankings, one is the session ranking. Where bandwidth in large K units, when the digital display 1000K, the actual use of network bandwidth needs x8, that is 8 m. Unicom's bandwidth is only 40M, so when a single user runs to close to 1000K, it indicates that its bandwidth usage is already high.
The session connection belongs to the bandwidth connection one auxiliary card, in general, uses the Thunderbolt and so on the tool, can cause many Half-open connection number, more than 300 sessions, namely means the user downloads or watches the Peer-to-peer video.
This column more highlights: http://www.bianceng.cnhttp://www.bianceng.cn/Network/Firewall/