Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installled wireshark on my server but can only monitor traffic through the local nic but all network traffic does not go through the server. I would like to monitor all network traffic.

Are there any good suggestions for software tools to monitor the complete network.

From reading it appears you would need to put a machine next to the router to access all traffic going through however I would I prefer not to do that at the moment. I have set up my router to log traffic but this is just general information.

Is there a tool that lets you do it, preferably free?

share|improve this question

closed as off-topic by joeqwerty, ewwhite, Greg Askew, MadHatter, mdpc Jan 6 at 3:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – joeqwerty, ewwhite, Greg Askew, MadHatter
If this question can be reworded to fit the rules in the help center, please edit the question.

2  
What exactly are you hoping to get from this? Running wireshark on all ingress and egress traffic is silly unless you're troubleshooting something. Trying to analyze PCAPs > 2GB is incredibly difficult, not to mention that you'll have a hell of a time finding any meaningful data in a raw PCAP of all traffic. Are you sure you don't want something like an outbound proxy that will give you metrics and reports on the different types of traffic leaving your environment? –  MDMarra Jan 5 at 19:14
1  
What would you like to monitor? Website activity? Protocols? Pr0n? Can you be more specific in what you're trying to accomplish? –  ewwhite Jan 5 at 19:16
    
If I understand what you want, you probably want to purchase some kind of dedicated firewall product with logging features. –  Katherine Villyard Jan 5 at 19:17
    
You already have the tool. Your problem is in the implementation. If you want to monitor all network traffic flowing in your switching infrastructure then you need to configure your switch(es) to send a copy of all traffic on all switch ports to a monitor port, where your monitoring station is connected. If you only want to see all traffic flowing inbound and outbound to and from the internet then you can set up a port monitor on your switch to firewall uplink or you can configure Netflow (or it's equivalent) on your router if it supports it. –  joeqwerty Jan 5 at 19:19
1  
I can think of a half dozen other ways to capture and monitor network traffic but they're all dependent on exactly what it is you're trying to see. –  joeqwerty Jan 5 at 19:20

1 Answer 1

up vote 3 down vote accepted

After reading your comments, there are a few different solutions you should employ.

  1. If you don't want rogue users on your network, employ 802.1x authentication at the switchport. This will prevent unauthorized devices from being connected to your network.

  2. If you periodically want to troubleshoot network issues, use port mirroring on your switch to duplicate the network port connected to the problematic device, you can then use wireshark to "listen in" on the traffic on that port. This is not something that you should leave running 24/7.

  3. If you want to monitor general network performance, you should use a network monitoring tool that can query your switch/router's metrics via SNMP. Programs like Nagios, SolarWinds Orion NMS, Microsoft System Center Operations Manager, and dozens of others can do this. This will give you historical insight into your network performance down to a per-port view.

Unless you're troubleshooting general ingress/egress traffic flow, which it doesn't sound like you are, then there's no reason to try and capture 100% of the traffic being routed in your environment.

share|improve this answer
    
Nagios? Nuh uh! –  ewwhite Jan 5 at 19:40
    
Nagios can do anything (if you have 1,000 hours to configure it). –  MDMarra Jan 5 at 19:42
    
Also a 4:th option of using NetFlow or one of it's derivatives for traffic analysis. –  ErikE Jan 5 at 22:02
    
Retaining all network flows is actually a great policy depending on how you do it (if it's reasonable on your companies budget, level of detail you retain, and for how long). I recommend looking into Riverbed Shark appliances. This is great for troubleshooting issues and doing NBA (network baseline analysis) for security reasons. –  Ormis Jan 9 at 15:24
3  
Retaining all network traffic is a great policy if you're the NSA. It's very impractical if you're at any significant size and don't have a blank check. If you have 100+ computers all with GbE connections, how can you possibly monitor every packet from every device and not create an enormous bottleneck somewhere? –  MDMarra Jan 9 at 15:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.