NetUse: How to monitor traffic on a Mac

We receive quite a few questions about a possibility using NetUse to monitor network traffic on a Mac only. MacOS Lion ( and Snow Leopard) gets shipped with SNMP daemon in place and just a few simple settings adjustments could make NetUse playing nice and show network traffic on a Mac.

Just a note: You are solely responsible for any damage to your computer systems, files or data, including any loss of data. This small how-to is mostly for educational purposes only and intended to show how to enable basic SNMP support on MacOS and requires some technical background.

We’re going to make a very minimal SNMP daemon configuration without any security considerations, etc. Standard MacOS Lion comes with a very well documented snmpd config file which explains to a most part all the available configuration options (some tehnical background is required to undestand what they’re talking about).

Modifying OS’s system files requires a use of a terminal application. So, start up a Terminal application and enter the following command:

sudo nano /etc/snmp/snmpd.conf

and press enter. The above command opens a SNMP configuration file  in a terminal based editor called nano under root user. If the above command asks for a password, just enter your current user’s password.

Here is a nano screen with opened snmpd.conf file for editing:

Using arrors key to navigate around the file you need to find this section:

# We limit unauthenticated requesters to the system contact info
rocommunity  public default .1.3.6.1.2.1.1.4

Edit the rocommunity string to look like this:

rocommunity  public default

It the screenshot above I’ve commented out (using a # symbol in a first position of a line) original line and added a new one right below it.

Once it’s done hit “Control+X” (not  a command button, a control button), nano will ask if you want to save the changes and a file name to save it to. Just hit Y to confirm save and press enter.

Now once the above is done we can start snmpd daemon and see if that works. Using a terminal run the following command:

sudo launchctl load -w /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist

From my experience it’s pretty common for all kinds of network appliances like routers, switches, etc to update SNMP agent counters in realtime ( i.e. at-least once a second). Howerver I’ve noticed this is not usually the case for network interfaces on computers. For instance on my Ubuntu server I’ve noticed it’s set to 10 seconds pull and on my mac it’s set to 3 seconds. It depends of course on a monitoring method you plan to use, butin our case for a NetUse’s real-time graph to work properly it’s required to be set to 1 second. Here is a command to see what your  nsCacheTimeout field is set for:

snmpwalk  -v1  -c public 192.168.1.119 NET-SNMP-AGENT-MIB::nsCacheTimeout.1.3.6.1.2.1.2.2

In my case I’ve got back:

NET-SNMP-AGENT-MIB::nsCacheTimeout.1.3.6.1.2.1.2.2 = INTEGER: 3

The timeout was set to 3 seconds. So I’ve changed it to 1:

snmpset -v1  -c private 192.168.1.119 NET-SNMP-AGENT-MIB::nsCacheTimeout.1.3.6.1.2.1.2.2 i 1

to verify that it was set to 1 second run the above snmpwalk again:

NET-SNMP-AGENT-MIB::nsCacheTimeout.1.3.6.1.2.1.2.2 = INTEGER: 1

Start NetUse, goto the Configuration Wizard and enter IP address of your Mac ( IP could be located in System preferences -> Network), hit a “Check My Network” button and select a network interface you want to monitor from a list.

Now you can monitor traffic on your Mac using NetUse over SNMP. Give it a try and let me know if you find this useful. The above howto doesn’t cover all the possible scenarios and gives just an idea on how NetUse could be used with a Mac.