-6

I have installled wireshark on my server but can only monitor traffic through the local nic but all network traffic does not go through the server. I would like to monitor all network traffic.

Are there any good suggestions for software tools to monitor the complete network.

From reading it appears you would need to put a machine next to the router to access all traffic going through however I would I prefer not to do that at the moment. I have set up my router to log traffic but this is just general information.

Is there a tool that lets you do it, preferably free?

Improve this question
7
  • 3
    What exactly are you hoping to get from this? Running wireshark on all ingress and egress traffic is silly unless you're troubleshooting something. Trying to analyze PCAPs > 2GB is incredibly difficult, not to mention that you'll have a hell of a time finding any meaningful data in a raw PCAP of all traffic. Are you sure you don't want something like an outbound proxy that will give you metrics and reports on the different types of traffic leaving your environment?
    – MDMarra
    Jan 5, 2014 at 19:14
  • 1
    What would you like to monitor? Website activity? Protocols? Pr0n? Can you be more specific in what you're trying to accomplish?
    – ewwhite
    Jan 5, 2014 at 19:16
  • If I understand what you want, you probably want to purchase some kind of dedicated firewall product with logging features.
    – Katherine Villyard
    Jan 5, 2014 at 19:17
  • You already have the tool. Your problem is in the implementation. If you want to monitor all network traffic flowing in your switching infrastructure then you need to configure your switch(es) to send a copy of all traffic on all switch ports to a monitor port, where your monitoring station is connected. If you only want to see all traffic flowing inbound and outbound to and from the internet then you can set up a port monitor on your switch to firewall uplink or you can configure Netflow (or it's equivalent) on your router if it supports it.
    – joeqwerty
    Jan 5, 2014 at 19:19
  • 1
    I can think of a half dozen other ways to capture and monitor network traffic but they're all dependent on exactly what it is you're trying to see.
    – joeqwerty
    Jan 5, 2014 at 19:20

1 Answer 1

Reset to default
3

After reading your comments, there are a few different solutions you should employ.

  1. If you don't want rogue users on your network, employ 802.1x authentication at the switchport. This will prevent unauthorized devices from being connected to your network.

  2. If you periodically want to troubleshoot network issues, use port mirroring on your switch to duplicate the network port connected to the problematic device, you can then use wireshark to "listen in" on the traffic on that port. This is not something that you should leave running 24/7.

  3. If you want to monitor general network performance, you should use a network monitoring tool that can query your switch/router's metrics via SNMP. Programs like Nagios, SolarWinds Orion NMS, Microsoft System Center Operations Manager, and dozens of others can do this. This will give you historical insight into your network performance down to a per-port view.

Unless you're troubleshooting general ingress/egress traffic flow, which it doesn't sound like you are, then there's no reason to try and capture 100% of the traffic being routed in your environment.

Improve this answer
6
  • Nagios? Nuh uh!
    – ewwhite
    Jan 5, 2014 at 19:40
  • Nagios can do anything (if you have 1,000 hours to configure it).
    – MDMarra
    Jan 5, 2014 at 19:42
  • Also a 4:th option of using NetFlow or one of it's derivatives for traffic analysis.
    – ErikE
    Jan 5, 2014 at 22:02
  • Retaining all network flows is actually a great policy depending on how you do it (if it's reasonable on your companies budget, level of detail you retain, and for how long). I recommend looking into Riverbed Shark appliances. This is great for troubleshooting issues and doing NBA (network baseline analysis) for security reasons.
    – Ormis
    Jan 9, 2014 at 15:24
  • 3
    Retaining all network traffic is a great policy if you're the NSA. It's very impractical if you're at any significant size and don't have a blank check. If you have 100+ computers all with GbE connections, how can you possibly monitor every packet from every device and not create an enormous bottleneck somewhere?
    – MDMarra
    Jan 9, 2014 at 15:32

Not the answer you're looking for? Browse other questions tagged .