Network Analyzer suggestions.

TechJunky

Anyone know of a good program to analyze network traffic?

I used to use EtherPeek when I worked for a corporation and it was the best network analyzer I have ever used, however it is pricey.

I am looking for a free program so I can tell who is using all of the bandwith within my office.

We have insanely weird sparatic ping times and I need to kill the user that is causing all the problems.

EtherReal doesnt seem to give me the data I need.

Thanks!

Slowhand

You might be looking for something like Nessus, or give the updated version of Ethereal a try, better known as WireShark, a try. You could give Snort a try too, that might be more of the type of traffic analyzer you're looking for. Other than that, you might be looking for a more "enterprise" solution, but it'll set you back some serious cash.

sexion8

Slowhand wrote:

You might be looking for something like Nessus, or give the updated version of Ethereal a try, better known as WireShark, a try. You could give Snort a try too, that might be more of the type of traffic analyzer you're looking for. Other than that, you might be looking for a more "enterprise" solution, but it'll set you back some serious cash.

Grr... Snort is not a network analyzer. Its an IDS. Wireshark is probably best since its open source, Kismet for Wireless, and DSniff is a must.

Slowhand

sexion8 wrote:

Grr... Snort is not a network analyzer. Its an IDS. Wireshark is probably best since its open source, Kismet for Wireless, and DSniff is a must.

That's very true, but if you take a look at his post, he said that Ethereal wasn't doing it for him. I'm well-aware the Snort is slated as an IDS, but you can install countless plugins to actually analyze the traffic, as well. If it does what he needs it to, then more power to him.

sexion8

Slowhand wrote:

sexion8 wrote:

Grr... Snort is not a network analyzer. Its an IDS. Wireshark is probably best since its open source, Kismet for Wireless, and DSniff is a must.

That's very true, but if you take a look at his post, he said that Ethereal wasn't doing it for him. I'm well-aware the Snort is slated as an IDS, but you can install countless plugins to actually analyze the traffic, as well. If it does what he needs it to, then more power to him.

Better would be to use ngrep than Snort or a combination of ngrep, awk butchered with your own flags. Snort has too many false positives to sift through. I rememeber a tool called Dragon IDS by Ron Gula (who happens to be one hell of a guy) when it was free, this was in my opinion the best tool of the time. Then it went commercial. You can still get the older versions and chop it up. Now that was an IDS!... IPS... Sentivist! Best of the best, as are the staff at NFR... Well the older ones.