full-disclosure - Re: looking for Network Trafic Monitoring software

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <AANLkTiniMdckdGQ+T7=fg0fpGLe=Jo+aFYtndT+b6iX8@mail.gmail.com>
Date: Sun, 27 Feb 2011 17:19:55 +0000
From: Nick Boyce <nick.boyce@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: looking for Network Trafic Monitoring software

On Sat, Feb 26, 2011 at 7:17 AM, Gopi Nath <gopinath601@...il.com> wrote:

> I want to check the traffic.  Because recently many times some systems
> were throughing more trafic.  It was difficult for me to check each and
> every system mannulaly .  Is there any tool which i can use to monitor
> the traffic of each and every workstation.

Your question really amounts to a dumb question on this list -
"monitoring the traffic" is at the heart of all network-defense, so
that's a sort of security-101 question.  Have you done _any_ research
into this yourself so far ?  It doesn't sound like you know very much
yet - there are hundreds of software tools for "monitoring traffic",
with varying functionalities.

A good first step for you would perhaps be to read all about these two
software packages (both available for Windows) and try them out so you
can discover whether or not they do what you need :
Wireshark: http://www.wireshark.org/
Snort: http://www.sourcefire.com/security-technologies/snort

You don't say what it is about your organisation's traffic that you
want to monitor .... do you want to check for *malicious* traffic, or
is it just traffic *overload* you're concerned about ?

For simple traffic load monitoring on a single broadcast-domain
network segment, in the Elder Days I liked a rather wonderful but very
simple package for [gulp] DOS, called ETHLOAD.  We installed it on a
PC and left it running all day in the corner of the office.  Any time
traffic increased beyond safe utilisation levels for that segment we
could see across the room to the ETHLOAD screen where the problem was
made very visually obvious, and could quickly get ETHLOAD to tell us
which workstation or server was responsible for the largest traffic
flows.

I don't know what tool is best for _that_ purpose now, but neither do
I know what it is you really want to do .... enlighten us.

Nick
--
Leave the Olympics in Greece, where they belong

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/