Forums > General Discussion > What network traffic/packet analyzer do you suggest?
comandante
1 post
5 Mar 2013 at 4:55 p.m. UTC

I have a client that has a software development company and hired me as a consultant, and he has some "power" users that seem to be executing some malicious utilities that are affecting the network's performance. I will implement Layer 2 protection (private vlans, dhcp snooping, ip source guard, port-security to limit MACs per port, etc) but the client wants to analyze the traffic that is going in and out the internet links, so the capturing and analyzer device has to be between the core switch and the router that connects the internet links. What tools/utilities do you recommend? are they PC based or appliance?
Suggestions will be deeply appreciated.
nola
24 posts
5 Mar 2013 at 9:44 p.m. UTC

RSA Netwitness..Ive never used a more comprehensive network security product.
altafk
40 posts
6 Mar 2013 at 11:06 a.m. UTC

wireshark installed on your laptop and make sure that your laptop is in line with the traffic, this can be done using port mirroring in switches or using a 3 port tap which acts like a hub, you can also try remote SPAN if it is cisco switches which mirrors one port/vlan traffic to any other port/vlan on different switch.
once you capture traffic you can use netwitness investigator to analyse the traffic easily.

the best thing about this is it is completely free with no hassles in setting up sniffing.

have a look at this site

http://wiki.wireshark.org/CaptureSetup
vigyu
1 post
7 Mar 2013 at 3:26 p.m. UTC

Hi,
You can use fprobe and nfdump tools on linux.
If you have many then you can use flowmon (http://www.invea-tech.com/products/flowmon) and a netflow analyzer such as solarwinds.
I used it before. These were very usefull.

Viewing 1 - 4 of 4

  • 1