Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am after an open source tool to monitor the network traffic of a small lan. I thought of wireshark but the amount of details it captures is massive. What I need is just a basic analysis of the network traffic by protocol, host, etc. I am going to run this in an old box with windows xp.


locked by HopelessN00b Jan 26 '15 at 6:42

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Jan 26 '15 at 0:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Try NTop, it is simple, open source and multiplatform.

I was quite interest when I read this, at least until I went to the web site. It might nominally be multiplatform but the only Windows binary is a severely crippled "demo" version. Not everyone is in a position to recompile on Windows and it would be quite a cumbersome job to recompile with any version of Visual C/C++, although there are instructions for compiling with MinGW (if anyone still uses that). In short, if you're not a programmer forget about the Windows version unless you want to buy it. – John Gardeniers Aug 12 '10 at 10:46
Sorry, I used ntop only on a linux machine and I didn't read with attention the download section of ntop site. – lg. Aug 12 '10 at 11:47

you still want Wireshark, and a bundle of filters to hide everything you're not interested in.

Capture filter will not capture the stuff you don't want, keeping log sizes down; Display filters will let you view the captured data easier and still drill-down into it, if (when) necessary.

There are tutorials, and I found the Wireshark docs to be very good.


Try TCPMon . This is a small java utility and shows few netweok activity bettwen the host and server.

This works fine on Windows Machine . You may try and see on Linux or Mac .


Wireshark, ntop, iptraf and such like are useful for investigating problems but not suitable for monitoring your network. You might want to have a google for MRTG, PasTMon, Nagios, Cacti, Scrutinizer, Argus



Not the answer you're looking for? Browse other questions tagged or ask your own question.