0

I am the system administrator. I am suspecting some unwanted data transfers in some of the computers under my lan. This also effects the overall performance of the network. Is there anyway by which i can check the transfered data over a particular interval. I am not supposed to install any applications on any other computers than mine. I have the router access. I can use tools like ettercap dsniff wireshark etc.

3
  • You could try port mirroring on the switches and attach ntop or iftop on the machine plugged in there. That should work in theory.
    – Sirex
    Dec 29, 2010 at 10:15
  • What OS? The answers for a Linux box will be very different from those for a Windows box.
    – MadHatter
    Dec 29, 2010 at 10:54
  • How do you suppose that it's affecting the overall performance of the network? Does the network use hubs instead of switches?
    – joeqwerty
    Dec 29, 2010 at 12:40

3 Answers 3

1

If you switches / routers support SNMP you could poll them with software like Cacti and make all kind of graphs.

0

Router / Switches have this functionality. Netflow can do that from a decent managed switch, including analysing where the traffic flows. Same router wise - or from any decent firewall.

Hard to give any more information on your hardware layout no answer is possible.

ettercap etc. are useless unless you put your switch into a mode mirroring all traffic to am anagement port - which then will make things SLOW.

I personally would go with netflow, but that would likely be a little too profesional (i.e. pricey) for a one time job.

1
  • I just found out the filtering capability of ettercap. I can drop all the packets destined to a particular compuetr using mitm attack. So instead of droping what if i count the packets?
    – defiant
    Dec 31, 2010 at 9:36
-1

One quicky answer would be to use the output from "ethtool -S eth0" which will give you statistics on this number of packets and/or bytes in and out of the port. The statistics available will be dependent on the device and driver - e.g. r8169 gives different info than e1000. You could set up periodic data logging of the port and watch the data rate over time.

2
  • Ah - retarded network, still using hubs? Otherwise the switch will make sure you only see traffic relevant for you. Which sort of sucks when you want to record traffic for over computer. Promisuous port - hope your LAN is not busy, as per my answer. On top, ethtool -S eth0 sort of assume this is valid on whatever router is used, which is not said.
    – TomTom
    Dec 29, 2010 at 11:10
  • Perhaps I wasn't clear that I meant using ethtool on the suspect computers, not on the routers: no special settings needed, no new software to be installed. This could even be driven remotely with ssh from the admin's computer and would work regardless of what routers or hubs are in place. Dec 31, 2010 at 6:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .