getting lan traffic

[AarzaK]

Hello,

I want to know what method is good to see the complete traffic on my lan, I want to see what computer generate more traffic and attack the problem in these computer.

I download ethereal, but this tools only retreive the traffic on my lan pc card, and I want to know all the lan.

Exist any tool to do its?

hope can help me.

Regards,

AarzaK

[MrLinus]

Are you attached to a switch by any chance?

What version of Ethereal?

[AarzaK]

Thanks for your reply!

I am using Ethereal Version 0.99.0

"Are you attached to a switch by any chance?"

good question, I am only openned the software, click "List the available capture interfaces..." and click on capture on my card.

[Aardpsymon]

yes, but what is your card plugged into?

And make sure promiscuous mode is enabled.

[AarzaK]

this is my card.

VIA PCI 10/100Mb Fast Ethernet Adapter (Microsoft's Packet Scheduler) : \Device\NPF_{86D89DC5-F63A-42FD-9D7B-E2B0CCCAE385}

This is directly to the switch.

the promiscuos mode is enabled

[MrLinus]

this is my card.

VIA PCI 10/100Mb Fast Ethernet Adapter (Microsoft's Packet Scheduler) : \Device\NPF_{86D89DC5-F63A-42FD-9D7B-E2B0CCCAE385}

This is directly to the switch.

the promiscuos mode is enabled

Switches prevent you from seeing all traffic. You'd have to mirror the port and/or use a hub instead.

[thehorse13]

Place your sniffer at a network choke point via a spanning port on a switch/router. You'll see more traffic than you'll know what to do with.

--Th13

[AarzaK]

Work in process, thanks all for your help.

AarzaK

[RoadClosed]

Bragging time... I have 2 of these:

http://www.packeteer.com/products/packetshaper/7500.cfm

Pretty colors:

//EDIT Looks like I have to get a cup of coffee and go talk to Mr. Flash Video there, since this is an OUTBOUND analysis ...

[Ranok]

Some switches have a monitor port, it's also temporarily possible to ARP spoof the other computers to pass their traffic through the monitoring station. However, a word of warning, most networking hardware is much faster at routing than a normal desktop, so by doing this, it'll slow down the network. I'd only do it on a small network, that I own, and make sure that all the users know I'm trying to find odd traffic.

Hopefully this helps,

n0k