Traffic Analyzer

Hi all. I need to know which kind of traffic goes/come to/from internet in my company. I was thinking to put some kind of linux machine with two NIC bridge mode between the firewall and the internet router with some software analyzer... Any idea or advice before I begin?

Thank you!

What do you mean "Which kind of traffic" Like which ports so you can distinguish that? Or something more like a traffic sniffer?

tcpdump, tethereal....

Sorry, I was not clear enough...

That I would like is capture the traffic with something like tcpdump and then analyze it at protocol/application level, I mean, know how many percent is http, smtp, etc... and origin destination of the traffic. I can't do it "by hand" or better "by eye" because is a gateway for a 500+ workstations, need some help in analysis or to do it at once if there is some software that makes it.

Hope I ecplain myself better....

Thank you.

Got an old hub lying around? Put it inline and attach any box capable of running Ethereal efficiently and there you go.

Or try this... It works quite well for getting a quick picture.

Is a switched network That's why I wanted to put a box between firewall and router.

I woul be ok if I was able to run the soft in the router or firewall, but none of them are windows.

I think that i need kind of high level traffic analyzer which works with tcpdump files for example...

ethereal is fine enuff....you can have a look at statistic from ethereal.
Moreove tethereal is ethereal CLI version.
Ethereal is also capable of understaning tcpdump files very well.

Hope Ethereal helps you.

Probably you will also love to have a look at IPTraf
http://iptraf.seul.org/
This one is good if you dont want to dump the traffic, but just see the stats.

Ok, if I'm using ethereal in a two nic box... How can I configure a bridge having the two nics in the same network???

You didn't say, but you really should be proficient in using Linux before tackling something like this. You could bring your network to a halt or open up holes.

How much have you read about Linux and Bridging?

Quote:

---

How can I configure a bridge having the two nics in the same network???

---

The nics would not have addresses, the box would be transparent to the network passing everything in then out.

Depending on the amount of traffic and connections of your host, you may want to consider something like a TAP instead of bridging? ( BTW, Tiger Shark's hub idea can be placed between the router and firewall like a TAP )

Have you checked out SNORT ?

Although it was designed as an IDS, you can pretty much make your own rules to have it do whatever you want. You can have it save the traffic to be read by something like tcpdump or Ethereal ( binary mode ), send it to a database, whatever. Very flexible.

You'll have to do a lot of reading and experimenting before putting it into production, even then you'll have to fine tune it to your needs. There are also programs such as Barnyard and BASE to support it. ( I'm using BASE with MySQL right now but I am no expert on this, I'm still playing! )

If you want all the trafic rotuter though it then id hardset both of the ips

Wow :) I've a lot of links to check now...

I'm used to administer Linux boxes and firewalls/routers, that I'm not used is to use a linux box as a router ;) I was wondering that shouls be enogh with something like iproute....

If you are running under Windows NT or 2000. You can use the utilities provided by the company:

[list=1][*]Server Monitor[*]Task Manager[*]Performance Monitor[*]Network Monitor: This utility is for finding out what is happening around your server at the packet level of network transmission. It also monitors all the traffic to and from the server. Furthermore it can be set to filter information from a particular node or address.[/list=1]

I'm doing the first steps... Since the firewall is some kind of unix I'm using tcpdump with a file capture that then download from firewall to my machine and analyze it with ethereal... Quite simple but effective!!! I'm playing with IO graphs...

i guess what important is what is the tools to use to view the network traffic percentage.. i also using ethereal to get packets.. but it is all in text format.. is there any software the can read ethereal saved files and present it in a grahpical format.. at least it is more clear to management level when doin presentations..

Graphical statisticas are avaible for analysis in "statistics" menu... Just load the CAP file go there and filter the traffic you want to see graphically...

echo 1 > /proc/sys/net/ipv4/ip_forward

ifconfig

route

route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.0.5

route add -net 192.168.0.0 netmask 255.255.255.0 gw 192.168.1.5

something along those lines should allow you to route a connection though 2 Nics, ive seen an article on this somehwere, its about making a knoppix router, but i just jotted this down in my note book for future reference.

Hope you can make some use of it

i2c