Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any applications (preferably free) for windows OS using which I can monitor the TCP/IP traffic of a remote machine (in the same intranet)?

share|improve this question
1  
What do you need to monitor this traffic for? –  lexsys Aug 13 '09 at 9:32

6 Answers 6

up vote 4 down vote accepted
  • Do you have access on the remote Windows machine?
    • If yes, there are a lot of ways you could do monitoring (depending on the depth of your requirements)
    • For example you could execute wireshark on the remote machine too
  • If you do not have access on that machine,
    • You are limited to what can be tapped on the network
    • Which requires access to the network
      (networks today typically do not broadcast any traffic, so snooping is difficult)
  • However, if you have access to the network devices, you could snoop over them
    • One example (already noted in another answer here) is to setup a proxy in the path
      • the Squid proxy has very good ways to track web activity (with some more tools)
    • Another is to mirror traffic for the user's port from one of the switches on the network.
    • Once you get a tap in the network path, a lot of options open up again

Assuming you are administering the network and probably the Windows machine in question,
You would have one of the above things workable.

share|improve this answer

Are you looking to monitor the URLs that they visit or malicious traffic in HTTP payloads?

If the former, use a proxy on the gateway device and set logging and make the proxy transparent.

If the latter use a managed Anti-virus suite.

share|improve this answer

If you want a detailed in depth analysis of content the you can use:

http://www.ethereal.com/

Both tools are free and quite powerfull.

share|improve this answer
5  
You should know this has been far superseded by Wireshark. The developer lost the trademark and domain of ethereal a while back, if you notice there's been no development on it. wireshark.org –  reconbot Aug 13 '09 at 13:38
    
Thanks for the info. I used Ethereal quite a while ago and I did not know this. –  Runner Aug 13 '09 at 14:26

Without resorting to ARP poisoning, you would need to use a proxy server or monitor traffic at the router/gateway. The only time we've had to do this was with logs at the proxy server due to accountability issues we're mandated to follow.

If you use a proxy like Squid you can then just parse the logfiles.

share|improve this answer

tcpdump nmap wireshark

share|improve this answer

If you have a managed switch between you and the remote machine you can simply mirror the traffic to the local machine and then use any monitor software with some suitable filter see How to monitor remote traffic

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.