+ Post New Thread
Results 1 to 11 of 11
How do you do....it? Thread, Analyse Network Traffic in Technical; I feel almost embarrassed to ask...but...I want to have a close look at the network traffic as things seem to ...
  1. #1

    SpuffMonkey's Avatar
    Join Date
    Jul 2005
    Posts
    2,268
    Thank Post
    55
    Thanked 285 Times in 191 Posts
    Rep Power
    136

    Analyse Network Traffic

    I feel almost embarrassed to ask...but...I want to have a close look at the network traffic as things seem to get a bit slow sometimes - and wondered about the best free way to do it. I downloaded Ethereal - as it was mentioned a lot - but having installed it on a server - it seemed to only look at traffic that was originating or destined for that server - what do I need to do to see the whole lot? And are there any freebies out there which are easy to interpret for the neophyte sniffer?

    Cheers

  2. #2

    mac_shinobi's Avatar
    Join Date
    Aug 2005
    Posts
    10,053
    Thank Post
    3,583
    Thanked 1,123 Times in 1,025 Posts
    Rep Power
    377

    Re: Analyse Network Traffic

    Didnt you get any software that came with your main switch or core switch or the switch you are trying to monitor.

    I know at the place I work my network manager ( aka kingswood on here ) used some software that came with the switch that showed traffic, I think there are 2 types of GUI's / interfaces ie web interface and a software type of interface.

  3. #3

    Join Date
    Jul 2005
    Location
    Corby
    Posts
    1,056
    Thank Post
    12
    Thanked 20 Times in 18 Posts
    Rep Power
    25

    Re: Analyse Network Traffic

    Hi Spuff.

    Yes- if you look at the type of switch you have and check with the manufacturer's web site you might be able to download some management tools for free that will do what you want (if you have managed switches). If not you will obviously have to go for a software solution- have you got any Linux boxes on your LAN? Or even a Knoppix or other live CD- if so you could use this:

    http://etherape.sourceforge.net/

    Geoff will know more- I haven't used this yet but have it ready on my Ubuntu box at home to test.

    HTH

    Paul

  4. #4

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    Boston, MA
    Posts
    7,601
    Thank Post
    110
    Thanked 771 Times in 599 Posts
    Rep Power
    183

    Re: Analyse Network Traffic

    @SpuffMonkey: If you think back to how switches work, they cleverly route the traffic to their destination so that the only unicast traffic on a partiular port will be destined for the device(s) connected to that port.

    You will need to enable promiscuous/debugging/etc. mode on one of the ports and plug a machine into that using promiscuous mode on its NIC - Ethereal will then show all the traffic on that switch.

    You will need managed switches for this and you will need to repeat the procedure for each core switch.

  5. #5

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,422
    Thank Post
    645
    Thanked 967 Times in 667 Posts
    Blog Entries
    2
    Rep Power
    328

    Re: Analyse Network Traffic

    Our Network Manager uses Colasoft Capsa, but uness you pay for it you can only run a scan/monitor for 30mins at a time.

  6. #6

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Analyse Network Traffic

    Nagios and Cacti are my favorites for System/Device monitoring (uses SNMP)

    For scanning and traffic monitoring I use a variety of tools such as iptraf, tcpdump, nmap and ntop.

    For security scanning I have been using Nessus however the licensing changes in v3 leave things hanging in the air.

    There are windows ports for most of these bits of software, although I find the Linux versions are better maintained and perform better.

    I think that covers all bases?

    Edit: Forgot to mention Snort for passively picking up all sorts of naughty traffic.

  7. #7

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,689
    Thank Post
    756
    Thanked 1,715 Times in 1,526 Posts
    Rep Power
    438

    Re: Analyse Network Traffic

    We use HP Procurve switches throughout and I have just been through a replacement program with them so I now have 1 x 2524 managed switch as the top switch in each cabinet the others being 2324's so at least I can telnet, web browse to the managed ones to give me an idea of traffic in that cabinet. Also have spanning tree turned on so if anyone creates a loop it should be restricted to that cabinet.

    The HP Web GUI is quite good at showing you alerts etc... for the switch.

    These also have the ability to replicate all the traffic on the switch to one port for monitoring. But if you did that on all switches and then had that port connected to your network you would be flooding your network with all the traffic generated and thus defeating the purpose of having a fully switched network.

    Hope that helps some,

    Ben

  8. #8

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Analyse Network Traffic

    The best way I find is to have all your traffic monitoring stuff on a laptop and plug it in as and when you need to monitor things on a switch.

    Its also useful to have two network cards and configure it as a bridge. That way you can plug it inline between devices and monitor traffic transparently.

  9. #9


    Join Date
    Dec 2005
    Location
    In the server room, with the lead pipe.
    Posts
    4,715
    Thank Post
    288
    Thanked 789 Times in 616 Posts
    Rep Power
    226

    Re: Analyse Network Traffic

    We use Etherape and Ntop here, plus I have periodic safaris using Ethereal.

    Etherape's good because it can tell you at a glance if something's getting hammered. Ntop performs the same function for your network that top does for a linux box. This all runs on a documentation / monitoring box.

  10. #10


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,033 Times in 813 Posts
    Rep Power
    341

    Re: Analyse Network Traffic

    We use Cacti / SNMP. Cacti produces lots of pretty graphs which management like and lots of info which I like. http://www.cacti.net/

    If your switches support syslog (ours dont') then use phpsyslog-ng
    http://www.phpwizardry.com/php-syslog-ng.php to get logs in a centralised location. - we have all our servers (inc windows) log to this, it makes checking log files a breeze, especially if the server won't boot

  11. #11

    m25man's Avatar
    Join Date
    Oct 2005
    Location
    Romford, Essex
    Posts
    1,682
    Thank Post
    49
    Thanked 484 Times in 351 Posts
    Rep Power
    144

    Re: Analyse Network Traffic

    I use Ethereal where possible and LanHound with remote agents.
    But you didn't say what it was you were trying to observe?

    As Ric said switches intelligently route traffic between MAC addresses so you need a way of ""sniffing" the traffic across the target node.

    Most good managed switches have Port Mirroring, just plug your lappy into an empty port and program the switch to mirror the link you wish to monitor to the port you have the lappy in easy.
    Protocol analyzers are brilliant for tracing unwanted traffic sources and worms but snmp is the best way to determine real time bandwidth usage.

    If you want to monitor realtime traffic then enable snmp on your servers and swtches and use Solarwinds to monitor the snmp agents.

    Solarwinds Engineers Edition is my tool of choice (www.solarwinds.net) but it's expensive so we get our school admins to buy the standard toolkit and teach them how to use it correctly.

    Cisco, HP and 3Com all come with extremely good network monitoring applications but almost everything else requires you to spend loads of cash on add on suites so there's one good reason to buy quality networking kit in the first place!



SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 4
    Last Post: 31st August 2007, 12:31 PM
  2. Unessasary network traffic from printers.
    By tosca925 in forum Wireless Networks
    Replies: 6
    Last Post: 14th August 2007, 11:10 PM
  3. Station Imaging And Network Traffic Saturation
    By DaveP in forum Wireless Networks
    Replies: 10
    Last Post: 31st January 2007, 10:35 PM
  4. Monitoring network traffic on our server
    By Kyle in forum Wireless Networks
    Replies: 6
    Last Post: 6th December 2006, 01:47 PM
  5. Web Traffic Via Outlook
    By shane_southampton in forum Windows
    Replies: 7
    Last Post: 13th September 2005, 11:12 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •