Newbie to networking but I want to monitor traffic, best?

detz · Apprentice Joined: 19 Feb 2004 Posts: 175

I would like to monitor traffic so I can tell if someone is access my computer. What's the best way to do all of this. I'm new to networking so the whole idea of firewalls and such are beyond me at this point.

Dizzutch · Posted: Tue Dec 07, 2004 5:38 pm Post subject:

there ar a whole bunch of program out there to monitor all kinds of traffic, what i use is this
to monitor who is logged in (ssh'd) into my machine i just 'who'
to monitor how much each of the computers on my network downloads/uploads i use 'ipfm' on my router
to monitor who accesses my webserver i use 'awstats'

hope these plus other peoples replys help you make a decision

Jule

detz · Apprentice Joined: 19 Feb 2004 Posts: 175

What's the best thing to monitor "attempt" to gain access? Right now my networking is not very secure since I have wireless on there so I want to be able to tell if someone is trying to get in. I don't care about traffic because I download all day and the only people that have access are my three computers and another family one.

idefix · n00b Joined: 15 Mar 2003 Posts: 23

Have you already looked at ntop? Its quite informative to find out who is downloading from where how much.

idefix

damg1nc · n00b Joined: 04 Jan 2003 Posts: 12 Location: Michigan

Another neat monitoring tool is iptraf... I have it running on my router, and use it pretty much as a glorified netstat. I check it every so often because one of my roommates can't seem to keep virii off his windows box... so I leave him nice messages when I see his computer trying to talk to random IP's on port 445.

I also watch my log files. You can also set up iptables to log packets that match rules... so if you wanted to, you could log all incoming new state connections to your computer.

racoontje · Veteran Joined: 19 Jul 2004 Posts: 1290

http://gentoo-portage.com/net-analyzer

Dizzutch · Posted: Wed Dec 08, 2004 2:16 pm Post subject:

d_m · Posted: Wed Dec 08, 2004 2:38 pm Post subject:

Suicidal · l33t Joined: 30 Jul 2003 Posts: 959 Location: /dev/null

Snort is real good, especially with snortsnarf or even ACID on a small network but ACID gets to slow on a large network as its database gets to big.

net-analyzer/trafshow is good for on the fly monitoring.

net-analyzer/darkstat has a nice web interface for showing which hosts are sending/reciveing the most data.

Snort will give you the most detialed information though, especially when you make your own rules.