network traffic monitor

[dcw@pr]

we are having very strange problems with our server, basically unexplained network traffic. I need to find a program that will monitor the traffic and tell me which port it is goign through. can anyone recommend software that will allow me to do this?

[BliarOut]

www.ethereal.com/

[jimmyjimjim]

Or observer, which I find easier to use than ethereal:-

www.networkinstruments.net/products/observer.asp

The trial download is limited to how much it can capture, but the real time displays aren't. I think.
Can't honestly remember as we've got god knows how many licenses.

[tinman0]

tcpdump command if you are using a real server


or, if you can mirror the port on the switch to another port, plug in a cheap linux box and run tcpdump on that.

>> Edited by tinman0 on Thursday 27th April 12:54

[TheExcession]

SnifferPro is a great product for taking a look at your hosts and the traffic they are passing... I've used it a lot in the past just to get an overview of what someones network is doing.

www.snifferpro.co.uk/

Unfortunately they don't offer a demo download any more but they did point to some other analysers here:
www.protocol-analyser.co.uk/download/protocol_analyser_download.htm

Maybe you know someone who has a copy of SnifferPro that they might lend you for a trial or something

[dcw@pr]

thanks for those. ethereal is good, but very complicated for a simpleton like me. I cannot seem to find if any of these packages offers a feature that allows me to set a transfer amount, say 50GB, that it will alert me if it has been passed. DO you know if this feature exists in any software?

[Plotloss]

I downloaded URL Snooper yesterday (shareware) for seeing where internet radio feeds actually come from.

Dont know if its in detail enough but its small and simple to use.

[TonyToniTone]

Have you tried running netstat on the server in question?

[TheExcession]

dcw@pr said:

thanks for those. ethereal is good, but very complicated for a simpleton like me. I cannot seem to find if any of these packages offers a feature that allows me to set a transfer amount, say 50GB, that it will alert me if it has been passed. DO you know if this feature exists in any software?

Ethereal is not really complicated per-se it's more a case of it won't give you the bigger picture. Ethereal by its nature expects you to have a good understanding of your network traffic and is generally used for looking at network problems in 'microscopic' detail - I've written disectors for Ethereal and we use it alot for debugging our satellite communication systems.

However... your requirements are quite different - If you were trying to isolate the fact that the latest RADIUS server you've introduced onto your network is encoding a 3GPP QoS Vendor Specific AVP incorrectly then I'd say download and use Ethereal, but from what you have said you need something that will give you some pretty diagrams showing what is happening on your network. You need a list of host PCs/Servers and some graphs that show where the majority of the traffic is going. Once you know this then you can begin to introduce filters to see exactly what is going on. I've used it before to arrive at the fact that 'your network ftp server has been hacked and a bunch of script kiddies who are using it to share bare lady naked movies....'

if you'd like a bit more help contact me via my profile...


EFART

>> Edited by TheExcession on Thursday 27th April 21:06