network traffic collection

[brokenarrow03]

I have a server that I installed a 3rd party print monitoring service on and the service connects to the vendors website and reports how many pages were printed per printer on that server, what program the document was sent through, which user sent it, etc.

I talked to one of the techincal people at this company about how much data was transmitted across our network and ultimately out the internet and what security it was using. After he satisfied my security concerns he said that it was kb of data and we should not see any noticable extra traffic across our WAN connections and out the internet.

I was looking the other day in our network traffice collecting software, Netflow Analyzer, and it said this particular server had transmitted almost 400MB out to the internet at 2:00AM, the time i specified it to upload this print data.

My question is I have always kind of had a hunch that our Netflow collector setup was always a little high on the reporting side, but was wondering if any fellow [H]'ers had any experience with any other apps that i could monitor this particular server and specifically the volume of traffic it is transmitting.

Or which collectors in WireShark should I set up to monitor port 6767 and get an accurate count of volume?

Thanks!!

 

[SpaceHonkey]

Some times the accuracy will depend on what's sending the flow. For instance some switches may only send a percentage of the traffic as flows for performance reasons. But to my knowledge there is no way that it will report more traffic than what actually passed.

We use Solarwinds NTA, works beautifully but it's not free.