3

Im getting some unexplainable happenings on my home network. Like lots of data being chewed. Ive got mac address filtering and WPA on, but it hasn't helped.

So I was wondering does anybody know of a program that will tell me how much each IP on the network has transferred? Maybe it needs to go through a proxy, which im fine about. I'll just route all data through my server. Basically i just want to find out if somebody else is getting onto my network somehow. So i need a network monitor.

Any help would be great!

Improve this question

5 Answers 5

Reset to default
1

A dual homed machine capable of acting as your gateway router would be perfect for this. Here's a howto that might help: http://www.stanford.edu/~fenn/linux/

Using that would permit you to watch the streams, packet counts, etc etc so you could examine every packet transmitting across your network.

Improve this answer
1

I've been using a package called Argus, written by Carter Bullard at Qosient. You feed it either a promiscuous network card, or a tcpdump file, and it outputs file containing the flow data for all the network traffic seen. It comes with a number of client programs for doing various and sundry types of analysis on the traffic. There is a switch to record MAC addresses, if seen.

Improve this answer
0

If you can put your card into promiscuous mode and the router sends all the packets, you can use wireshark to watch/analyse traffic.

Improve this answer
0

install netmon 3.3 from here: Network Monitor 3.3 is available here

Use the top users expert in network monitor 3.3 See Top Users Expert for Network Monitor 3.3

Once you've installed the expert by running the MSI, "Top Users by Endpoint" and/or "Top Users by Conversation" will appear in the experts menu. Once you run the expert a new window will show up and display a data grid. The data will depend on any display filters applied or conversation tree nodes you might have selected. The data grid contains a list of nodes or conversations and then statics on the frames and bytes that have been sent and/or received.

By using the expert you don't need to worry about how to analyze the data yourself, the tool will do it for you. If you know nothing about netmon (or network analyzers) watch this video intro:

Network Monitor (Netmon) 3.3 Overview

Improve this answer
0

I've been using NTOP for a few years now; haven't had any reason to try/use anything else. Will give you traffic for each IP and where the traffic has gone/come from for each IP

www.ntop.org/

Improve this answer
1
  • The problem with NTOP is that unless your switch is configured (or can be configured) to send all traffic to the machine running ntop, you only see local traffic plus broadcasts.
    – Matt Simmons
    Jun 1, 2009 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.