Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to determine what sort of data is coming or going from my domain. The activity light on my modem and firewall are flashing like crazy regardless of the number of actual computers connected. When I disconnect the systems I still see the traffic. How can I peek onto that side of the firewall?

share|improve this question
    
Check if your router supports SNMP (most of them do), and run a daemon on one of your boxes to pull the info into a file which you can then analyse. –  user3914 Jun 30 '10 at 21:22

3 Answers 3

up vote 2 down vote accepted

From the Snapgear Administration Guide you can do a packet capture direct from the firewall. From the firewall's System menu, click on Diagnostics, then Packet Capture. Once you've got a few seconds worth of packets, you can view it right from the firewall. Alternately, and what I'd probably recommend, is that you can download the cap file, and view it in something like Wireshark. This should at least let you see the type, source, and destination packets of your traffic.

Probably random crap from the Internet being spewed in your direction...


--Christopher Karel

share|improve this answer

Direct packet dumps (tcpdump, wireshark, and friends) are good but you'll probably like something more high-level. If you can get all the traffic (via an hub as already said or via a linux or other unix system with two ethernet cards in bridging) you can run ntop on that host and see detailed realtime reports of your network traffic.

share|improve this answer
    
It should be noted that ntop can read pcap files as input. (-f <file> flag) So you can perform analysis on a cap file you download from the firewall using the instructions I included above. Otherwise, a very good answer. –  Christopher Karel Jul 1 '10 at 0:57

Probably not a whole lot of exciting things are going on. The lights flash like crazy even when small amounts of data are going across the wire.

If you want to see what's going on, you can sniff the packets. Download and install Wireshark on your computer. Then hook up a hub (hub, not a switch) between your firewall and modem. Plug your computer into the hub, launch Wireshark and start sniffing away.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.