up vote 0 down vote favorite
share [g+] share [fb]

I am searching for a windows desktop application which will monitor the LAN traffic (promiscuous mode -- PORTS and Destination IPs) and show me stats, graphs etc

I need to know if anyone PC is infected with Virus, which desktop is consuming how much bandwidth and via which application etc.

I have seen WireShark, but its too technical and low level. I need something more high level.

link|improve this question
1  
WireShark, WinPCap, off-topic. – leppie Jul 12 '11 at 10:05
1  
Err... if WireShark is too technical, then I wonder how you will use whatever monitoring solution to detect viruses. Also note that usually LANs are switched so you won't get a lot of traffic to you, better have statistics collection done on the switch (if it's something beyond a $10 switch from the local hardware store, you can use SNMP software to get just what you want) – cdegroot Jul 12 '11 at 10:51
so do you want this to be a distributed IDS as in each desktop will be running this? – tony roth Jul 12 '11 at 16:49
2  
Get a good AV suite and it will monitor for viruses. Doing this manually is nuts. – Chris S♦ Jul 12 '11 at 17:29
feedback

migrated from stackoverflow.com Jul 12 '11 at 14:41

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 1 down vote

Network-level Monitoring:

For long-term monitoring, ntop is useful; it will be in promiscuous mode, and summarizes traffic stats.

System-level Monitoring

See this answer -> http://serverfault.com/questions/279164/top-like-tool-for-ip-traffic/279166#279166

link|improve this answer
feedback
up vote 1 down vote

In a typical modern network, this will most probably not give you what you want, due to the network being switched.

From a single machine, you may see probes from other machines, aimed at that specific host (or sent as broadcast). You won't see traffic aimed at the Internet.

You can probably get some of what you want by interrogating the SNMP agent on your switch(es), that should give you traffic levels and the like. Typically, virus activities tend to cause noticeably higher traffic levels.

If you have a router that supports NetFlow, you can get more detailed statistics from that.

Unfortunately, I do not know of any cheap tool that will give you a nice GUI for what you want. If that is what you want, it may be worth investigation what tools your network device vendor(s) have that can help you. Personally, I would probably just write the necessary analysis and report-generating code, using snmplib and an open-source netflow collector for data collection.

link|improve this answer
feedback
up vote 1 down vote

I'd suggest snort but you said Wireshark was too technical. :( Maybe check it out anyway. http://www.snort.org/

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard