I've been trying to find a tool for monitoring my home network. Before I go into the details, I've looked at a ton of different software and they're either an overkill or don't have what I'm looking for. Hopefully the community can help me with some advice.
My network is quite small. It consists of a modem connected to a D-Link DI-524 router. To this router I have a number of computers hooked up wirelessly.
What I'm looking for is a lightweight tool for monitoring my traffic. The ideal tool would have a GUI that shows an icon of the router, and icons of all devices connected to the router with a bandwidth indicator on the lines connecting the nodes. That's pretty much it.
I'm not sure if my router has SNMP. This might be a dealbreaker since many of the cheaper routers don't. I've also read somewhere that many routers can be monitored over UDP.
Found tnv after quick googling.
tnv (The Network Visualizer or
Time-based Network Visualizer) depicts
network traffic by visualizing packets
and links between local and remote
hosts.
Here is a list of good tools to monitor network activity.
Looks like MRTG was the best tool to use
I have also been pleased with the Serial and USB software provided by HHD Software. I've never used their Network version, but if its as good as the USB and Serial, its probably pretty good. Here is the free trial version.
you can use CACTI and Mikrotik DUDE.
Related
I have a small home network that I would like to analyze and capture the traffic on. What are my options for doing this? Ultimately, I would like to use a packet capture library, such as libpcap, to sniff the network in real-time as my router receives packets. I'm mainly interested in HTTP traffic. Thus far, when I run my program, I only seem to be able to see packets sourced or destined to my machine. Is there a way that I may inspect any traffic that travels through my wireless modem/router?
From the research I've done, it seems that the only way this is possible is through ARP poisoning or using a CISCO router that features Embedded Packet Capture.
Has anyone tried either of these and how successful were you? Are these my only options or is there something I may have overlooked?
Hi :) I think ARP poisoning and so on is not so easy to drop in.. ;) but you could start by trying one of the most famous network packets analyzer: Wireshark. Networking is very far to be easy.. :P but Wireshark will help you a lot and, btw, supports also libcap. Hope that helps :)
Im looking for a network simulator similar to ciscos packet tracer but does more types of devices then just ciscos. Anyone know of a such program? Im not wanting to actually send fake traffic over my network but emulate a fake network within one computer.
I would give you two points if I could for anyone that lists open source links.
Found GNS3 and it works great and can even send out fake packets on a virtualized network or the fake network limited to the gui in the software.
Found GNS3 except I can not figure out how to add a pc to configure.
Anyone know how to do so? They list a tutorial but not one with virtual pc or virtual box.
Edit:
heres the GNS3 website to download their program:
http://www.GNS3.net
I have created a bandwidth meter application to measure total Internet traffic. I need to test the application with relatively high data transfer rates, such as 4 Mbps. I have a slow Internet connection, so I need a simulator to test my application to see the behavior with high throughput rates.
As an option, you can run some HTTP server in one virtual machine with NAT'ed network adapter and test your bandwidth meter against it from the host system or a similar VM.
There are commercial packet generators that do this, and also a few freely available ones like PackETH and Bit-Twist.
There are also other creative solutions. For example, do the packets need to be IP packets for your purpose? If not, you could always get a "dumb" switch or hub (no spanning-tree or other loop protection) and plug a crossover cable into it. (or a straight-through Ethernet cable would work if the switch supports Auto-MDIX) The idea would be that with a loop in your network, the hub/switch will flood the network to 100% for you since it will continually re-forward the same packets.
If you try this, be sure yours is the only computer on the network, since this technique will effectively render it useless. ;-)
You could always send some IP broadcast packets to "seed" the loop. Otherwise, the first thing I think you'd likely see is broadcast ARP packets, which won't help if you're measuring layer 3 traffic only.
Lastly, (and especially if this sounds like too much trouble) I recommend you read up on dependency injection and refactor your code so you can test it without the need for a high-speed interface. Of course, you'll still need to test your code in a real high-speed environment, but doing this will give you much more confidence in your code.
I have 2 network devices that talk to each other over Ethernet. I would like to sniff the traffic using Wireshark. But the devices are going through a switch. The switch routes the traffic to only the ports that need the data.
At another location I have a hub. All the traffic is repeated across all the ports.
Is there a way to tell the switch to send the traffic down my port also?
EDIT: This is an unmanaged switch.
You might want to look into ARP spoofing.
http://en.wikipedia.org/wiki/ARP_poisoning
Since this is an unmanaged switch, the only way that I can think of is to temporarily put a hub between the switch and one of the devices you want to monitor, then plug a laptop into that hub to do the monitoring. The laptop should now see all traffic between the device and the switch.
This is pretty easy since you can do it at the location of one of the devices. You just need a hub, two more lengths of CAT cable and the computer you are using to monitor with.
The switch may have a management interface that lets you do that. Be warned that if you do, you'll wreck performance on the switch since everything attached to it will now have to deal with collisions.
If the switch is a managed switch, it likely has a mode to act like a hub. Just be careful not to leave it like that.
Some will also have ways to mirror ports and such as well. You need to find out what kind of switch it is.
RE Edit: If it is unmanaged, then you are boned. Use a hub, a managed switch or run wireshark on the computer(s) affected.
You could try a port redirector, like this one. You would configure one device to talk to your computer instead of the other device, and the redirector will send the data to the real target. There are several programs like this out there, or you could write your own.
How can I connect a system to a network and sniff for virus/spyware related traffic? I'd like to plug in a network cable, fire up an appropriate tool sand have it scan the data for any signs of problems. I don't expect this to find everything, and this is not to prevent initial infection but to help determine if there is anything trying to actively infect other system/causing network problems.
Running a regular network sniffer and manually looking through the results is no good unless the traffic is really obvious,but I havn't been able to find any tool to scan a network data stream automatically.
I highly recommend running Snort on a machine somewhere near the core of your network, and span (mirror) one (or more) ports from somewhere along your core network path to the machine in question.
Snort has the ability to scan network traffic it sees, and automatically notify you via various methods if it sees something suspicious. This could even be taken further, if desired, to automatically disconnect devices, et cetera, if it finds something.
Use snort: An open source network intrusion prevention and detection system.
Wireshark, formerly ethereal is a great tool, but will not notify you or scan for viruses. Wireshark is a free packet sniffer and protocol analyzer.
Use the netstat -b command to see which processes have which ports open.
Use CPorts to see a list of ports and the associated programs, and have the ability to close those ports.
Download a free anti-virus program such as free AVG.
Setup your firewall more tightly.
Setup a gateway computer to let all network traffic go through. Take the above recommendataions to the gateway computer instead. You will be checking your whole network instead of just your one computer.
You can make Snort scan traffic for viruses. I think this will be the best solution for you.
For watching local network traffic your best bet (with a decent switch) is to set your switch to route all packets out a specific interface (as well as whatever interface it would normally send). This lets you monitor the entire network by dumping traffic down a specific port.
On a 100 megabit network, however, you'll want a gigabit port on your switch to plug it into, or to filter on protocol (e.g. trim out HTTP, FTP, printing, traffic from the fileserver, etc.), or your switch's buffers are going to fill up pretty much instantly and it'll start dropping whatever packets it needs to (and your network performance will die).
The problem with that approach is that most networks today are on switches, not hubs. So, if you plug a machine with a packet sniffer into the switch, it will only be able to see traffic to and from the sniffing machine; and network broadcasts.
As a followup to Ferruccio's comment you will need to find some method of getting around your switches.
A number of network switches have the option of setting up port mirrors, so that all traffic (regardless of the destination) will be copied, or "mirrored", to a nominated port. If you could configure your switch to do this then you would be able to attach your network sniffer here.
Network Magic, if you don't mind something that's not open source.
You can use an IDS, hardware or software
http://en.wikipedia.org/wiki/Intrusion-detection_system