Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im getting some unexplainable happenings on my home network. Like lots of data being chewed. Ive got mac address filtering and WPA on, but it hasn't helped.

So I was wondering does anybody know of a program that will tell me how much each IP on the network has transferred? Maybe it needs to go through a proxy, which im fine about. I'll just route all data through my server. Basically i just want to find out if somebody else is getting onto my network somehow. So i need a network monitor.

Any help would be great!

share|improve this question
up vote 1 down vote accepted

A dual homed machine capable of acting as your gateway router would be perfect for this. Here's a howto that might help:

Using that would permit you to watch the streams, packet counts, etc etc so you could examine every packet transmitting across your network.

share|improve this answer

I've been using a package called Argus, written by Carter Bullard at Qosient. You feed it either a promiscuous network card, or a tcpdump file, and it outputs file containing the flow data for all the network traffic seen. It comes with a number of client programs for doing various and sundry types of analysis on the traffic. There is a switch to record MAC addresses, if seen.

share|improve this answer

If you can put your card into promiscuous mode and the router sends all the packets, you can use wireshark to watch/analyse traffic.

share|improve this answer

install netmon 3.3 from here: Network Monitor 3.3 is available here

Use the top users expert in network monitor 3.3 See Top Users Expert for Network Monitor 3.3

Once you've installed the expert by running the MSI, "Top Users by Endpoint" and/or "Top Users by Conversation" will appear in the experts menu. Once you run the expert a new window will show up and display a data grid. The data will depend on any display filters applied or conversation tree nodes you might have selected. The data grid contains a list of nodes or conversations and then statics on the frames and bytes that have been sent and/or received.

By using the expert you don't need to worry about how to analyze the data yourself, the tool will do it for you. If you know nothing about netmon (or network analyzers) watch this video intro:

Network Monitor (Netmon) 3.3 Overview

share|improve this answer

I've been using NTOP for a few years now; haven't had any reason to try/use anything else. Will give you traffic for each IP and where the traffic has gone/come from for each IP

share|improve this answer
The problem with NTOP is that unless your switch is configured (or can be configured) to send all traffic to the machine running ntop, you only see local traffic plus broadcasts. – Matt Simmons Jun 1 '09 at 3:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.