Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am searching for a windows desktop application which will monitor the LAN traffic (promiscuous mode -- PORTS and Destination IPs) and show me stats, graphs etc

I need to know if anyone PC is infected with Virus, which desktop is consuming how much bandwidth and via which application etc.

I have seen WireShark, but its too technical and low level. I need something more high level.


migration rejected from Jan 21 '15 at 19:08

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by HopelessN00b Jan 21 '15 at 19:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

WireShark, WinPCap, off-topic. – leppie Jul 12 '11 at 10:05
Err... if WireShark is too technical, then I wonder how you will use whatever monitoring solution to detect viruses. Also note that usually LANs are switched so you won't get a lot of traffic to you, better have statistics collection done on the switch (if it's something beyond a $10 switch from the local hardware store, you can use SNMP software to get just what you want) – cdegroot Jul 12 '11 at 10:51
so do you want this to be a distributed IDS as in each desktop will be running this? – tony roth Jul 12 '11 at 16:49
Get a good AV suite and it will monitor for viruses. Doing this manually is nuts. – Chris S Jul 12 '11 at 17:29

In a typical modern network, this will most probably not give you what you want, due to the network being switched.

From a single machine, you may see probes from other machines, aimed at that specific host (or sent as broadcast). You won't see traffic aimed at the Internet.

You can probably get some of what you want by interrogating the SNMP agent on your switch(es), that should give you traffic levels and the like. Typically, virus activities tend to cause noticeably higher traffic levels.

If you have a router that supports NetFlow, you can get more detailed statistics from that.

Unfortunately, I do not know of any cheap tool that will give you a nice GUI for what you want. If that is what you want, it may be worth investigation what tools your network device vendor(s) have that can help you. Personally, I would probably just write the necessary analysis and report-generating code, using snmplib and an open-source netflow collector for data collection.


I'd suggest snort but you said Wireshark was too technical. :( Maybe check it out anyway.