39

tcp.port==443 in the filter window (mac)


13

Hostgroups and templates. Templates let you define classes for your hosts and services, e.g. "normal service", "critical service", "low-priority host". They also serve as a useful way to divide responsibilities if you've got multiple teams with different responsibilities, so you can have a "linux host" template and a "windows host" template, with each one ...


6

Make extensive use of service and hostgroups, and templating. Create hostgroups, and assign services to the hostgroups. Use servicegroups for dependencies, escalations, and logical grouping in the web UI. If you have groups for everything, adding a new host is just 3 or 4 lines: name, address, template(s), and (optionally) hostgroups. Everything can be ...


6

You can use the "tls" filter: TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're looking for.


6

Filter tcp.port==443 and then use the (Pre)-Master-Secret obtained from a web browser to decrypt the traffic. Some helpful links: https://security.stackexchange.com/questions/35639/decrypting-tls-in-wireshark-when-using-dhe-rsa-ciphersuites/42350#42350 https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ "Since ...


6

Performance Monitor (perfmon.exe) is great for monitoring in windows. Run perfmon.exe and click the plus button to add the counters that you want to monitor. Depending on your VPN, you probably want the IPsec counters. Add everything that says IPsec in the name, then watch the live graph to determine the interesting counters for your setup. From there you ...


5

Install Microsoft Network Monitor. Start a Capture. Filter the Capture for DNS, HTTP and HTTPS. Look at the captured results. NetMon will list each process responsible for it's corresponding network traffic, which should allow you to track it down. Granted that the DNS client process is going to be responsible for any DNS related traffic relevant to Yahoo, ...


5

You could use nping from nmap like: C:\>nping --tcp -p 80 192.168.1.1 where -p specifies the port to scan (here: 80). Furthermore you can use -H for hiding sent packets, in favor of showing only replies.


5

Yes, you can monitor the standalone ESXi Host using any SNMP monitoring software but some items may only be visible using a monitoring tool that supports the CIM protocol. All of my ESXi Hosts are part of vCenter but we monitor them directly (using the vmkernal Host IP address) with SolarWinds NPM. There are 5 or 6 CIM modules built into ESXi 5.5 that give ...


4

if you have the IP address it is trying to connect to, just add it as an alias to an interface on eth port 5. Then your machine will now answer as that IP address and you should be able to use any HTTP server to send the file back. On the linux box assuming you have an ethernet interfaces called eth0 and eth1. Eth0 is connected to your upstream(ISP,...


4

You can either do email-to-SMS via one of the commercial gateways, or send the SMSs directly from your NAGIOS box via GSM-enabled hardware. There are many commercial email-to-SMS gateways, they are often country-specific, and we don't do service recommendations here on SF, so I won't try to give one. The upside of this is it's easy to do and requires no ...


4

No, there is no such logfile. You have to specifically set up logging to do that, and I am not aware of a standard way to do it. It may not be easy to do it accurately: a user may cause a process that isn't owned by that user to generate network traffic and it may not be trivial to ascribe that traffic to that user. See e.g. this near-duplicate question or ...


4

It is very simple: with iptables, you can track the users as well. Theoretically, you could block/delete/redirect their packets, but now currently you only want to measure them. It is very simple, because iptables by default tracks all of the data getting through their rules. An example code is here: iptables -A OUTPUT -o eth0 -m owner --uid-owner 1001 ...


4

The output of my dstat -n seems to be showing the Meg or K of my net traffic. This is with version 0.7.2 on my Ubuntu 12.04 LTS host. ----total-cpu-usage---- -dsk/total- -net/total- ---paging-- ---system-- usr sys idl wai hiq siq| read writ| recv send| in out | int csw 4 3 92 1 0 0| 93k 119k| 0 0 | 0 0 |3023 4760 15 2 ...


4

I understand what you're looking for; specific notes on how to manage and monitor the health of a standalone VMware ESXi host. In practice, the approach should be slightly different. I'll explain how I manage hosts. In a situation where you have multiple ESXi hosts under vCenter management, the assumption is that you leverage the vCenter for monitoring and ...


4

Setup a DNS server on hardware, and enable logging. Force all your clients to use it with configuration combined with firewall rules blocking clients from access DNS servers other then your DNS server.


4

@Zoredache's answer is the ideal answer for long term monitoring (and control) but for short term monitoring there is the widely available dnstop(8) Capturing packets or reading a pcap file, it can display domains broken down by zone level, query and response types, and other fun oddities.


3

After reading your comments, there are a few different solutions you should employ. If you don't want rogue users on your network, employ 802.1x authentication at the switchport. This will prevent unauthorized devices from being connected to your network. If you periodically want to troubleshoot network issues, use port mirroring on your switch to duplicate ...


3

I'm already doing this, and have been for some time, using munin and a custom plugin I wrote myself, which gets data from iptables audit rules. It's running on a C6 box so you should be able to fork-lift it into place if no-one has any better ideas. It's not the simple one-liner you wanted, but it's working, and produces data like these: The plugin is ...


3

It should not work like this. You should install a http proxy on a server (ie. your linux box) and tell all your clients to use this http proxy. You can tell them to reconfigure their browsers with a PAC file. Then you disable http access on your firewall so they cannot bypass your http proxy. Such http proxy is Squid. It has many tools which can generate ...


3

For logging: TCP Dump For Monitoring: Iftop For ~0 Setup / configuration: iptables -A INPUT -j LOG; tail -F /var/log/messages Will show all inbound packets netstat -punta Will show all active / listening connections and any programs associated with them. ifconfig -a generally has packet counts. (My understanding is that ifconfig is on its way out... ...


3

If you have a set of real end-users, they're almost always better than a monitoring service. I manage quite a few mail systems (mostly Exchange), and any sort of outage immediately spurs phone calls and inquiries about whether the mail server is down.|when it'll be back?|where is my email?|I'll kill you! This is one case where I don't do anything ...


3

IIRC Wireshark is copying data received by the network interface and working on them. I don't think it's possible to detect usage of Wireshark or other tools like tcpdump on network layer. On OS layer you might can check wether a device is entering promiscuous mode which indicates something is listening at the device.


3

Check out the ss utility. ss -an


3

You asked for ideas and... here is mine. To solve your problem, you've two very limiting conditions: You're unable to take hands on your Cisco ('cause it's not yours and its configuration cannot be changed to suite your needs); You cannot change (at least, not easily) the way Zeroshell is working (due to the very nature of Zeroshell itself [it's quite ...


3

It means that the connection state is unknown. EDIT Upon further information: I'm using Cport from Nirsoft. A quick check of their documentation says "items with unknown state (the state column is empty) are displayed." So my answer was actually more right than I realized. =) This means that no explicit state for the port is available. Probably ...


3

1 - query logging Enable query logging rndc querylog and parse your log files, like this: grep -Eo "client ([0-9]{1,3}[\.]){3}[0-9]{1,3}" /path/to/logfile | sort -u | uniq client 10.0.252.1 client 10.0.231.15 client 127.0.0.1 excluding duplicates | uniq and | wc -l to count them, but don't mind to find a real solution that will be really accurate and ...


3

Benchmarks for monitoring environments always differ and numbers won't apply to your requirements. Although there's a rich community for each project on its own where you may ask others to share their experience. Comparison charts look fancy but I doubt they will help with anything. Which is why we don't have them on icinga.org anymore - if you want to ...


3

Just use netsh trace start capture=yes without any of the other stuff. This gets you just a basic packet capture that you can view in Network Monitor. You don't need to use the ETW providers like NetConnection unless you're troubleshooting a Windows Filtering Platform problem or something. You don't need the convert command at all.


3

Large Scale means what in your case? 10? 100? 1000? 10000? 100000? What type of equipment do you want to monitor? Workstations? Office PCs? Servers? Routers? Switches? Industial controllers? You didn't tell us the most basic information, so I would like to downvote your question, but I can't - Lucky You ;-) In spite of missing information, some simple ...


Only top voted, non community-wiki answers of a minimum length are eligible