monitoring network trafic

[akramh]

Hi, just wondering if you know about any good solution that monitors network trafic and works with windows 7, I want to know what is happening on my wireless network, who is doing what etc, I have about 4-5 PCs connected and want to minitor how they use the network and who is taking the bandwidth, and who is connected. I tried using look@LAN but it seems it doesn't work very well for PCs that are firewalled, it doesn't even detect them, they still get an IP address from the router and connect to the internet but I have no way to monitor them or know they are actually using the network, thanks

 

[sup3rsprt]

what kind of router do you have? Using a router with special firmware is one of the best ways to monitor the network.

 

[zigzag3143]

packet sniffer

Hi, just wondering if you know about any good solution that monitors network trafic and works with windows 7, I want to know what is happening on my wireless network, who is doing what etc, I have about 4-5 PCs connected and want to minitor how they use the network and who is taking the bandwidth, and who is connected. I tried using look@LAN but it seems it doesn't work very well for PCs that are firewalled, it doesn't even detect them, they still get an IP address from the router and connect to the internet but I have no way to monitor them or know they are actually using the network, thanks

do you want just to know who is talking to who, or do you want to know every single bit of info?

There are applications that do both

Ken

 

[akramh]

First I want to know who is using the network, just to make sure nobody is on the network that I don't know of. I have a linksys WRT54GC, yeah with the C in the end it means I cannot run the tomato firmware.

once I know who is on the network, I want to know what are they doing, like what applications are they using, normal browsing or torrent or whatever they are doing, and how much bandwidth they are taking, that's all.

I have done some searches on google, and it does seem possible if I can run the tomato firmware but I can't run it on the WRT54GC . if i logon to the WRT54GC administrator console through the browser, I can check the IP addresses that have been given through DHCP, and some of them I can't ping and not sure who they are... here is a pic that shows the info I can see, but this is all I can see. I cannot even ping some of the unknown ones, could be a firewall blocking the ping duno

 

[zigzag3143]

Packet Sniffers

First I want to know who is using the network, just to make sure nobody is on the network that I don't know of. I have a linksys WRT54GC, yeah with the C in the end it means I cannot run the tomato firmware.

once I know who is on the network, I want to know what are they doing, like what applications are they using, normal browsing or torrent or whatever they are doing, and how much bandwidth they are taking, that's all.

I have done some searches on google, and it does seem possible if I can run the tomato firmware but I can't run it on the WRT54GC . if i logon to the WRT54GC administrator console through the browser, I can check the IP addresses that have been given through DHCP, and some of them I can't ping and not sure who they are... here is a pic that shows the info I can see, but this is all I can see. I cannot even ping some of the unknown ones, could be a firewall blocking the ping duno

All the data that goes into and out of a pc is sent and received in packets. from the packets you can tell what the machines mac address is, what their IP is, read their passords, uid, anything that is sent in clear text. the one thing a packet sniffer cannot do is tell if they are playing a game on the pc or opening a folder.
Anything external web browser, email, IM, can be decyphered by a packet sniffer. the biggest BUT is there is a big learning curve. They are hard to learn. there are several light weight sniffers like wireshark, or etherpeek NX. wireshark is free and easiest to use. there is tons of data so dont ask for everything be specific and they will be easier to use

I hope this has helped somewhat

Ken

 

[Barman58]

Hi akramh

If you need a full blown network scanner compatible with Windows 7 - Microsoft's own network monitor is available on the connect site ...

https://connect.microsoft.com/site/sitehome.aspx?SiteID=216

You will need to log-in with a Microsoft live ID to download

 

[akramh]

Thanks for the info guys, I'll give wireshark a try I guess.
barman56, I don't have a Microsoft Live ID to download it, is there a way to get a trial version of that software? how do you get a Microsoft Live ID anyway?

 

[sup3rsprt]

live ID is free. just sign up using your e-mail address.

https://accountservices.passport.net/ppnetworkhome.srf?lc=1033

EDIT - Or download the Network Monitor without signing up.

http://www.microsoft.com/downloads/...FamilyID=983b941d-06cb-4658-b7f6-3088333d062f

 

[Barman58]

Windows Live Sign-up ...

Sign In

 

[akramh]

oh thanks how stupid of me, I already have a windows live ID! I misunderstood I thought your talking about something like technet lol thanks for the links guys.

also tried that Wireshark, v1.2 beta but it's a no go with Windows 7, I do have another PC i could try it with that's running XP though, so might do that, but since I can get a trial for Microsoft's own network monitor I will look into that first as it sounds promising!

 

[zigzag3143]

packet sniffers

Everyone I like MS as well but unless you install the core and parser set you are only getting a stripted down lite version

The Network Monitor core engine has been decoupled from the parser set. To install the full Network Monitor 3.3 product:

• Run the setup.exe for the platform you are installing.
• You will be prompted first to install the core engine. Follow the installation directions. Make sure you close existing instances of netmon.exe, nmcap.exe and any running NMAPI applications.
• Next you will be prompted to install the parser package. Follow the installation directions:

As a beginner I thought the OP would think the ease of use would be the most important factor.

Ken

 

[sup3rsprt]

A packet sniffer probably isn't going to give you enough info to work with, unless you do something like perform MITM, spoof the router's MAC address, or setup a mirrored port which the Linksys probably cannot do.

If anyone is wired into the router via ethernet, the switch inside the router will prevent you from sniffing other people's traffic (besides doing the techniques I mentioned above).

 

[akramh]

A packet sniffer probably isn't going to give you enough info to work with, unless you do something like perform MITM, spoof the router's MAC address, or setup a mirrored port which the Linksys probably cannot do.

If anyone is wired into the router via ethernet, the switch inside the router will prevent you from sniffing other people's traffic (besides doing the techniques I mentioned above).

Yea this is what I read in some places while googling, so MITM/Spoofing the router's MAC address/setting up mirrored port are all not supported with the linksys routers?

I played around a little with Wireshark, but it seems it can only monitor the local trafic on the locally installed NICs, unless you have something installed on the other computers... when I tried to monitor a remote computer it said that the server software was maybe not running on it....

 

[zigzag3143]

packet sniffer

A packet sniffer probably isn't going to give you enough info to work with, unless you do something like perform MITM, spoof the router's MAC address, or setup a mirrored port which the Linksys probably cannot do.

If anyone is wired into the router via ethernet, the switch inside the router will prevent you from sniffing other people's traffic (besides doing the techniques I mentioned above).

Not if It has remotes like Observer, and is not passive, or he runs it in the DMZ

K

 

[sup3rsprt]

you can do MITM or MAC spoofing on just about any router. Mirrored port will require special firmware on Linksys.

Not if It has remotes like Observer, and is not passive, or he runs it in the DMZ

K

remotes like Observer?

DMZ is not even real on Linksys routers. It's just Masquerade.

 

[zigzag3143]

remotes like Observer?

DMZ is not even real on Linksys routers. It's just Masquerade.

Yep I knew you were lurking. I said nothing abt Linksys.

Ken

 

[sup3rsprt]

akramh has a Linksys router. Why you talking about DMZ?

I played around a little with Wireshark, but it seems it can only monitor the local trafic on the locally installed NICs, unless you have something installed on the other computers... when I tried to monitor a remote computer it said that the server software was maybe not running on it....

Wireshark can monitor in promiscuous mode depending on your NIC and depending on if your wireless NIC supports monitor mode. I think you should be able to sniff other people's traffic with it, but it is not a very good solution unless you're an expert at reading packet captures.

 

[akramh]

you can do MITM or MAC spoofing on just about any router. Mirrored port will require special firmware on Linksys.

ok you know of any guides that I can use to do that? what software is used?

btw started playing around with microsoft network minotor 3.3, I noticed there is "My trafic" and "Other Trafic" sections, under "My trafic" I can see the applications that are on my PC that are using the net. on "other trafic" I can see the IP Addresses that are on the network, one of them I can't even ping but I can see some information on it, but not detailed, like I don't know what applications are being used and how much badwidth, here is a screen shot:

 

[zigzag3143]

again

akramh has a Linksys router. Why you talking about DMZ?



Wireshark can monitor in promiscuous mode depending on your NIC and depending on if your wireless NIC supports monitor mode. I think you should be able to sniff other people's traffic with it, but it is not a very good solution unless you're an expert at reading packet captures.

I suggested wireshark because its easy and free. I could have just as easily said MS, so. I said observer, and etherpeek in case the OP ever gets to the point where he know enough to want more, and Yes I am expert an captures, but he isn't when he plays some he will ask more questions and after all isn't that why we do this? We are here to help not bicker.

Ken

 

[sup3rsprt]

ok you know of any guides that I can use to do that? what software is used?

This will help you learn about MITM.

SlimJim100 - Live Demo of Cain & Able and the Man-in-the-middle-attack from Outerz0ne 5 (Hacking Illustrated Series InfoSec Tutorial Videos)

Once you are routing everyone's traffic, Wireshark will be much more effective.