Monitoring Tools

This program is an optional component in Windows 2000 Server,
and is useful for network administrators for monitoring network traffic. To add
it, you have to go to Add/Remove programs and select Add/Remove Windows
Components. Then, in Management and Networking Tools, select Microsoft Network
Monitor. The version installed is 2.0 Lite, which has most of the advanced
features disabled. For the software to be fully enabled, you’ll need to buy
and install Microsoft Systems Management Server.

How it works

Microsoft Network Monitor captures packets flowing to or from
your server and stores them in a temporary directory. You can also capture
packets flowing between specific computers on the network, but that option is
available only in the full version. You can open up this temporary file and
analyze the captured packets. Each captured packet is treated as a frame, and
the temporary file contains information such as description, protocol, source
computer, and destination computer for each frame. You can click on any specific
frame to get more information on it, such as length, protocol and the contents
of the frame in hexadecimal code.

If you want a more focused set of packets to be monitored,
then you can use filters. Here you can specify the protocols to be monitored,
the computers to be monitored, and the direction of flow of packets–that is,
to the server, from the server, or both ways.

Overall, a quick utility to monitor network traffic.

NetWare’s TCP/IP Console

This utility in NetWare can be used to get statistics and
information on machines that are running TCP/IP on your network. To start it,
type load TCPCON at the server command line. You’ll now see a screen, which
shows various statistics such as IP received, sent, and forwarded, TCP
connections, and TCP received and sent, and uptime. There’s a menu below this,
which has more options like protocol information–which gives information on
IP, ICMP, UDP, TCP, OSPF, and EGP protocols, Statistics, and Interfaces.

The information that you see is for the server you’re
working on. To get information on remote clients, first make sure that they’re
running SNMP. In Win 98, you do this by going to Network Neighborhood
Properties, and adding Services. One of the options you get is SNMP agent for
NetWare. This has to be installed. Now, in the SNMP access configuration menu,
change transport protocol from local system to TCP/IP. In the host field, give
the client’s IP address. Then, save the settings and exit. You’ll now start
getting information for that client.

Similar to TCPCON, there’s a utility called IPXCON for
monitoring IPX activity.

tcpdump for Linux

tcpdump is a packet sniffer–a tool that can capture and see
the contents of all packets flowing across the network. You can find tcpdump in
the RedHat CD as an RPM. You run tcpdump as:

tcpdump

Doing this would clutter your screen with information on all
the packets passing through your network. A good idea is to redirect the output
of tcpdump to a file for later analysis.

tcpdump > analysis.log

tcpdump can take in many command line parameters. Some of the
frequently used ones are:

-c count : show count number of packets

-e : show the link level header

-q : print less protocol information

-i iface : listen to interface iface, for example, eth0

-n : list numeric addresses and port numbers

-N : show only the hostname instead of FQDN (Fully
Qualified Domain Name)

-s X : capture X number of bytes from each packet

-S : show absolute TCP sequence numbers

-v and -vv : increases the amount of information. -vv
gives more information than -v

By default, the interface listened to is eth0–the first
interface found after the loopback interface lo. The number of bytes captured by
default–which is 68–suffices for most purposes. -e and -q are useful for
peeking into the link header and to get less–but easy to read–information on
each packet, respectively.

You may not be looking for all the packets that flow through
your network. So, you can capture packets flowing through selective hosts. For
this use tcpdump’s filtering expressions, in which you can use
"and", "or" and "not" to build up the filter you
want.

Some of the common filtering expressions are:

type : type can be host, net or port, the default is
host

src hostip : specify the IP address of the originating
host

dst hostip : specify the IP address of the destination
host

host hostip : specify the IP address of the host, for
which you want to monitor all packets–to and from

src port : specify the source port of the packets

dst port : specify the destination port of the packets

port : specify the port, to monitor packets to and from

protocol : specify the protocol used by the packet, for
example, TCP, IP, UDP, ICMP, ARP, RARP, etc

Let’s take a few examples here.

tcpdump host 192.168.1.22

will capture all incoming and outgoing packets from the
machine with IP 192.168.1.22

tcpdump src 192.168.1.22 and dst 192. 168.1.1

will capture all packets moving from 192.168.1.1 to
192.168.1.22. Note the use of "and" here.

You can capture packets of specific protocols, as in:

tcpdump tcp

To capture all packets destined to a specific port, like ftp:

tcpdump host 192.168.1.22 and port ftp

If you use a port’s name like ftp, it must be defined in
/etc/services. Alternatively, you can use the port number, 21 in this case.

Output of tcpdump

The tcpdump output contains a line corresponding to each
packet it has gone through. The format of each line depends on the protocol in
use–TCP, UDP, ICMP, IP, etc. In any case, each line contains the time at which
the packet is received. You can use the -t option to remove the time. For
continuous network monitoring, run tcpdump on a separate terminal, or open a
terminal window in X and start tcpdump in it. You can filter specific network
traffic you want to see, by piping out the output of tcpdump to grep as:

tcpdump | grep Broadcast

It’s highly recommended that you go through the manual
pages of tcpdump. It provides myriad options for efficient network monitoring.

If you want to do a graphical analysis of your network
traffic, you can opt for tools like ethereal–downloadable from http://ethereal.zing.org,
or ntop–downloadable from http://www-serra. unipi.it/~ntop

Sachin Makhija and Shekhar Govindarajan