IP-traffic monitoring

mariourk · Posted: Wed Nov 01, 2006 10:44 am Post subject: IP-traffic monitoring

I'm having some bandwith problems on my network. To figure out
where the problem was, I installed ntop. Now I can see someone is using
emule and bittorrent to download stuff, wich is not authorised in our
network. Now I need to figure out where it comes from in order to
shut it down. Problem is that I don't know how to obtain the guilty IP-address.

Hopefully someone can tell me how to do that?
_________________
If there is one thing to learn from history, it's that we usualy don't learn anything from it, at all.

Errtu · Apprentice Joined: 12 Nov 2002 Posts: 155 Location: Brazil

You can use tcpdump (emerge tcpdump) for that. Or simply block the non-standard ports on your firewall.

linuxtuxhellsinki · l33t Joined: 15 Nov 2004 Posts: 700 Location: Hellsinki

Maybe you could use some of these packages to find it out ? With first two you can only catch data for your own interface (I think) but with etherape you could see which IF is really active on your network.

swimmer · Posted: Wed Nov 01, 2006 11:09 am Post subject:

May I add jnettop?

n3bul4 · Apprentice Joined: 04 Nov 2003 Posts: 187

Hello,

maybe you could yust simply set up an iptables rule, where you
block and log all traffic from emule and bittorrent

I googled a little bit and found out, that emule uses the following ports:

local port 4661 TCP outgoing to remote port 4661
remote port 4662 TCP incoming to local port 4662
local port 4665 UDP outgoing to remote port 4665
local port 4672 UDP outgoing to remote port 4672

I am not sure what ports bittorrent uses...maybe it is a range of ports.....

An other maybe faster option would be to emerge tcpdump and do somthing like:

Errtu · Apprentice Joined: 12 Nov 2002 Posts: 155 Location: Brazil

I don't know anything about emule, but with bittorrent you can specify any port you'd like. I really think that tracking down individual users is too time-consuming. It would be better to just allow some ports (21/80/443/etc) and block everything else.

arndawg · Tux's lil' helper Joined: 02 Jun 2006 Posts: 97

With bittorrent you can use what ever port you want. Some torrent-networks even require you to use a non-standard bit-torrent port.
Some viruses on Windows acctually installs bit-torrent and use the pcs for bit-torrent seeding. I've experienced this on my network. uTorrent was the client of choice.

So a more strict firewall policy is recommended even if you find the source.

Good luck.

mariourk · Posted: Wed Nov 01, 2006 2:17 pm Post subject:

People, thanks a lot for all the suggestions and good will

I think I'm going for tcpdump for now. Fortunately I'm also working
on a new router and I think I going to introduce a new policy when
it goes online. Blokking all the forward-traffic except for a few ports.
Maybe I'll even log those ports, if it doesn't consume too much diskspace...

Thanks again!

_________________
If there is one thing to learn from history, it's that we usualy don't learn anything from it, at all.