I am the system administrator. I am suspecting some unwanted data transfers in some of the computers under my lan. This also effects the overall performance of the network. Is there anyway by which i can check the transfered data over a particular interval. I am not supposed to install any applications on any other computers than mine. I have the router access. I can use tools like ettercap dsniff wireshark etc.

  • You could try port mirroring on the switches and attach ntop or iftop on the machine plugged in there. That should work in theory. – Sirex Dec 29 '10 at 10:15
  • What OS? The answers for a Linux box will be very different from those for a Windows box. – MadHatter Dec 29 '10 at 10:54
  • How do you suppose that it's affecting the overall performance of the network? Does the network use hubs instead of switches? – joeqwerty Dec 29 '10 at 12:40

If you switches / routers support SNMP you could poll them with software like Cacti and make all kind of graphs.

| improve this answer | |

Router / Switches have this functionality. Netflow can do that from a decent managed switch, including analysing where the traffic flows. Same router wise - or from any decent firewall.

Hard to give any more information on your hardware layout no answer is possible.

ettercap etc. are useless unless you put your switch into a mode mirroring all traffic to am anagement port - which then will make things SLOW.

I personally would go with netflow, but that would likely be a little too profesional (i.e. pricey) for a one time job.

| improve this answer | |
  • I just found out the filtering capability of ettercap. I can drop all the packets destined to a particular compuetr using mitm attack. So instead of droping what if i count the packets? – defiant Dec 31 '10 at 9:36

One quicky answer would be to use the output from "ethtool -S eth0" which will give you statistics on this number of packets and/or bytes in and out of the port. The statistics available will be dependent on the device and driver - e.g. r8169 gives different info than e1000. You could set up periodic data logging of the port and watch the data rate over time.

| improve this answer | |
  • Ah - retarded network, still using hubs? Otherwise the switch will make sure you only see traffic relevant for you. Which sort of sucks when you want to record traffic for over computer. Promisuous port - hope your LAN is not busy, as per my answer. On top, ethtool -S eth0 sort of assume this is valid on whatever router is used, which is not said. – TomTom Dec 29 '10 at 11:10
  • Perhaps I wasn't clear that I meant using ethtool on the suspect computers, not on the routers: no special settings needed, no new software to be installed. This could even be driven remotely with ssh from the admin's computer and would work regardless of what routers or hubs are in place. – Shannon Nelson Dec 31 '10 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.