Im getting some unexplainable happenings on my home network. Like lots of data being chewed. Ive got mac address filtering and WPA on, but it hasn't helped.
So I was wondering does anybody know of a program that will tell me how much each IP on the network has transferred? Maybe it needs to go through a proxy, which im fine about. I'll just route all data through my server. Basically i just want to find out if somebody else is getting onto my network somehow. So i need a network monitor.
I've been using a package called Argus, written by Carter Bullard at Qosient. You feed it either a promiscuous network card, or a tcpdump file, and it outputs file containing the flow data for all the network traffic seen. It comes with a number of client programs for doing various and sundry types of analysis on the traffic. There is a switch to record MAC addresses, if seen.
Once you've installed the expert by
running the MSI, "Top Users by
Endpoint" and/or "Top Users by
Conversation" will appear in the
experts menu. Once you run the expert
a new window will show up and display
a data grid. The data will depend on
any display filters applied or
conversation tree nodes you might have
selected. The data grid contains a
list of nodes or conversations and
then statics on the frames and bytes
that have been sent and/or received.
By using the expert you don't need to worry about how to analyze the data yourself, the tool will do it for you. If you know nothing about netmon (or network analyzers) watch this video intro: