Sniffing on my lan HELP

Question

Sniffing on my lan HELP

ladnir (IS/IT--Management)

(OP)

5 Feb 11 16:09

he i have been looking into ways to monitor my lan in order to keep it running fast and to see who is misusing it or slowing it down. my network looks like this.

i would like to what bandwidth each computer is using. what their traffic is ie. what websites they view. Warnings if my ping get to high and any other good network monitoring tools.

i am not completely sure how to go about doing this. from what i understand because i have a switch i am going to have to do some trickery to be able to see the traffic. something along the lines of ARP poisoning.

i am looking for someone to point me in the right direction and any other helpful hints.

thank

OssGuy (IS/IT--Management) · Answer 1 · 2011-03-22 05:08:10

Hi.

Looking at your diagram, you might have some difficulty in instrumenting a network analysers (be it a freebee like wireshark on a laptop, or something more sophisticated like a netscout infinistream.

You've got two options, SPAN and TAP.

SPANS (sometimes called mirror ports) are types of ports on switches that can send a copy of data on a port to another port for monitoring, most CISCO and HP switches allow this.

TAPS are effectivly the physical equivilent of spans. e.g. http://www.nxtera.co.uk/Solutions/Gigamon.aspx

Once you have got instrumented its a case of capturing. You can use wireshark with your NIC set to promiscuous mode to see data, better still look at a network analyser with a disk drive -> the difficulty is often recreating an issue or timing your capture to get the 1/2 second burst that tells you what the problem is. Something like an infinistream http://www.nxtera.co.uk/Solutions/NetScout/Infinistream.aspx will help you do this. These tend to be fairly expensive, but will cut your investigation times significatly.

Final option, you could get some proffessional services, these guys are very good and use netscout hardware to diagnose faults.
http://www.nxtera.co.uk/ManagedITServices/AssurePaQ3.aspx

Good luck

The OSS Guy

OssGuy (IS/IT--Management) · Answer 2 · 2011-03-22 05:10:51

What Cisco switches are you using, is there a spare point on each for SPANning?

Come Join Us!

Posting Guidelines

Sniffing on my lan HELP