getting lan traffic

Printable View

March 19th, 2007, 02:18 PM
AarzaK

getting lan traffic

Hello,

I want to know what method is good to see the complete traffic on my lan, I want to see what computer generate more traffic and attack the problem in these computer.

I download ethereal, but this tools only retreive the traffic on my lan pc card, and I want to know all the lan.

Exist any tool to do its?

hope can help me.

Regards,

AarzaK
March 19th, 2007, 02:51 PM
MrLinus

Are you attached to a switch by any chance?

What version of Ethereal?
March 19th, 2007, 03:20 PM
AarzaK

Thanks for your reply!

I am using Ethereal Version 0.99.0

"Are you attached to a switch by any chance?"

good question, I am only openned the software, click "List the available capture interfaces..." and click on capture on my card.
March 19th, 2007, 03:22 PM
Aardpsymon

yes, but what is your card plugged into?

And make sure promiscuous mode is enabled.
March 19th, 2007, 03:53 PM
AarzaK

this is my card.

VIA PCI 10/100Mb Fast Ethernet Adapter (Microsoft's Packet Scheduler) : \Device\NPF_{86D89DC5-F63A-42FD-9D7B-E2B0CCCAE385}

This is directly to the switch.

the promiscuos mode is enabled
March 19th, 2007, 04:11 PM
MrLinus

Quote:

Originally Posted by AarzaK

this is my card.

VIA PCI 10/100Mb Fast Ethernet Adapter (Microsoft's Packet Scheduler) : \Device\NPF_{86D89DC5-F63A-42FD-9D7B-E2B0CCCAE385}

This is directly to the switch.

the promiscuos mode is enabled

Switches prevent you from seeing all traffic. You'd have to mirror the port and/or use a hub instead.
March 19th, 2007, 07:05 PM
thehorse13

Place your sniffer at a network choke point via a spanning port on a switch/router. You'll see more traffic than you'll know what to do with.

--Th13
March 21st, 2007, 04:16 PM
AarzaK

Work in process, thanks all for your help.

AarzaK
March 22nd, 2007, 03:52 PM
RoadClosed

1 Attachment(s)

Bragging time... I have 2 of these:

http://www.packeteer.com/products/packetshaper/7500.cfm

Pretty colors:

//EDIT Looks like I have to get a cup of coffee and go talk to Mr. Flash Video there, since this is an OUTBOUND analysis ...
April 4th, 2007, 10:19 PM
Ranok

Some switches have a monitor port, it's also temporarily possible to ARP spoof the other computers to pass their traffic through the monitoring station. However, a word of warning, most networking hardware is much faster at routing than a normal desktop, so by doing this, it'll slow down the network. I'd only do it on a small network, that I own, and make sure that all the users know I'm trying to find odd traffic.

Hopefully this helps,

n0k
April 5th, 2007, 02:24 AM
oofki

A lot of switches do not have a mirroring mode that makes the switch act like a hub. If this is the case ARP poisioning is the easiest way to obtain the traffic.
April 10th, 2007, 11:19 PM
thehorse13

Quote:

Originally Posted by oofki

A lot of switches do not have a mirroring mode that makes the switch act like a hub. If this is the case ARP poisioning is the easiest way to obtain the traffic.

Actually, that is incorrect and also dangerous.

First, if you ARP poison a network, you run the risk of taking the whole damn thing down, especially if you have an underpowered box. You could DoS your entire organization and also earn a pair of shiny bracelets that you wear on your way out the door. They don't have nice network labs in jail.

If your device does not have a span/mirror port, use a "Y" line tap (layer 1 repeater, i.e., a mini hub) immediately upstream from the switch. You can then watch inbound/outbound connections to that subnet.

--TH13