Tools to Analyze your Network Traffic

Remember the good old packet capturing utilities? Those wonderful tools that
capture all traffic flowing across your network to tell you what's wrong. Well,
they're undergoing a change, and today they can do much more than packet
capturing. So much so that many packet capture utilities have rechristened
themsevles as protocol analyzers. As the name suggests, a protocol analyzer will
give you a complete report on the protocols flowing across your network. At the
core, they're still packet capture utilities, but they give you a protocol wise
breakup of the traffic, so that it's easier to analyze. Protocol analyzers are
useful in many ways. If your network is choked for instance, and you can't
figure out what's causing it, then you can easily find out what's wrong by
running a protocol analyzer. Likewise, if any of your applications are not
responding, say your mail server is taking ages to send out mails, then again
you can bring a protocol analyzer to the rescue. For instance, we've had
experiences in the past where a mail server had been completely choked by a mass
mailing worm. We ran a protocol analyzer and were able to detect not only the
nature of the worm, but also the machines infected by it. A protocol analyzer
tells you the exact problem.

Using the decode module of sniffer portable, you can see details of captured packets in human readable format

A network protocol analyzer captures a copy of the packets flowing across
your network and decodes them with information about the physical and logical
addresses from where these packets are coming and going to, their sequence
numbers, protocol used by the packets and other similar information. They let
you determine the health of your network packet by packet.

Sometimes protocol analyzers are also referred to as 'Sniffers'. A network
protocol analyzer can be a hardware appliance or just a piece of software
running on a laptop or desktop. Protocol analyzers usually are of two types,
namely, distributed and standalone. Distributed protocol analyzers like OmniPeek
allow you to capture packets from a number of nodes on the network at the same
time, while the standalone ones operate from one node only. In this article, you
will find standalone protocol analyzers, which we have divided into four
categories. The first category contains protocol analyzers for WiFi networks.
The second one is meant for wired networks, and there's a third only for
analyzing HTTP protocols. Lastly are the do-it-all protocol analyzers.

How to deploy

If you want to analyze the traffic going out of your organization, then you
should put your protocol analyzer between your Firewall and main network switch.
If you are using a protocol analyzer from any port of your switch then make
sure, you point it to your organization's gateway. Otherwise, you will only get
broadcast and multicast packets from that port. Some switches have a special
port known as SPAN (Switched Port Analyzer) which is specifically meant for
traffic analysis purposes. The concept of SPAN port started due to the basic
differences between hub and switch. While hubs broadcast traffic to all ports,
switches contain it between the source and destination ports only. A SPAN port
will capture all traffic.

Features

Now that you know how to deploy a protocol analyzer, let's look at the kind
of features you can expect to find in a good protocol analyzer.

Decode: After a packet has been captured, a protocol analyzer will
decode it into human readable format using it's decode module. While it may not
be able to decode all contents of a packet, it provides various useful
information which otherwise can be hard to understand.

Expert analysis: This feature gives a detailed view of the events
taking place on the network. Based on algorithms present in the protocol
analyzer, it gives a diagnosis of the network which includes information like
severe events, key trends, utilization, etc.Packet generation: Many protocol
analyzers allow you to create your own customized packets and send them across
the network. This is used for various purposes, such as stress testing a network
or you can send packets to specific nodes to check their behavior.

Triggers: These are used to stop or start traffic capturing, when a
particular network event takes place or at a particular time.

Address book: An address book entry usually contains information about
IP addresses, MAC addresses, descriptions and the hostnames of the nodes.

Filters: Filters are used for capturing only the required data for a
specific condition. This saves your valuable time of going through all the
captured packets, before you can find what you are looking for and also saves
the buffer size. Filters can be based on IP addresses, protocols, MAC addresses,
etc. Filters can be applied to capture data and also on captured data.

Reports: You can create reports of network behavior, which can be
useful during network audits and also for understanding the trends on your
network.

All in Ones: Wireshark

In 1997 a need for tracking down networking problems and a quest for knowing
more about networking prompted Gerald Combs to start writing Ethereal, so as to
fulfill both these needs. Since then lots of development has happened and now it
has re-emerged under a new name called Wireshark. It is a piece of software that
understands the structure of different network protocols, thus it's able to
capture packets and interpret their meanings. Wireshark uses pcap to capture
packets, hence restricting capturing of packets only to pcap supported networks.
Some of the major features of Wireshark include its capability to capture
packets not only from wired networks but also from wireless networks. Live data
can be read and the captured file can be edited or converted using editcap
program. It also has a display filter, which selectively highlights and colors
packet summary information. This can be used to refine data display. It has the
capability to dissect hundreds of protocols. It can be run on almost all OSs
from Linux, Solaris, UNIX and Windows to MAC OS X.

OmniPeek Enterprise

Omnipeek Enterprise can work as a distributed network analyzer, when used with
OmniEngines, else it works as a standalone protocol analyzer. With OmniPeek, you
can capture traffic from WAN links, WLAN, 10/100/1000 Ethernet networks, etc.
OmniPeek is easy to use. It gives you a live picture of the network, as soon as
it starts capturing packets. It provides various features like Expert Analysis,
Peer maps, Live graphs of the network, Protocol and node statistics, etc.
Another useful feature that OmniPeek has is Visual expert. It comes with tools
which can be used to do a detailed analysis of the data flows. One of the tools
is Packet Visualize, which shows conversations between a server and a client and
provides expert diagnosis of the conversation with the summary.

OmniPeek's Expert system diagnosis feature lets you identity problems
occurring in the network by the diagnosis of conversations taking place in the
network. It gives a complete analysis of conversation flows with detailed event
logs and node information which can be easily understood and lets you identify
problems quickly. Its expert 'EventFinder' feature gives remedies, descriptions
and likely cause of the problem which is identified by the Expert diagnosis
module.

Observer

OBserver can run on wired as well as the wireless networks. It provides instant
view of captured packets and can also present them in human readable format,
which is pretty similar to Ethereal's interface. OBserver is capable of
providing information about things like Network summary, Bandwidth utilization,
Access point load monitor and VLAN analysis in real time. The software has
pretty effective filters, which help users to analyze the network easily, by
only showing the relevant data which is useful and required by the user. When
OBserver finds any error or warning such as attack or problem in the network, it
can also alert the user by firing up e-mails and pager messages. It also has a
feature called Traffic generation with the help of which it can stress test your
network by generating heavy traffics. It also provides VLAN analysis, Internet
OBsersver analysis, Router OBserver etc. It provides network trending and
detailed reporting to help you keep an eye on overall health of your network.

Under the channel option you can check the


stats of each and every channel

Wired Protocol Analyzers: Packetyzer

It's a network protocol analyzer again based on Ethereal project and also
sometimes referred to as packet sniffer. It includes open source Ethereal packet
capture and dissection library. It decodes various protocols including the ones
from wireless LAN, virtual LAN and 802.1x. It applies sophisticated packet
filtering to filter and search specific packets. Its filtering is very powerful.
It is possible to filter on addresses, both MAC and IP, by protocol, by port
number etc. Complex filter can be built up by combining elements. It captures
packets form the network and can provide live detailed information of the
packets. It is configurable and can capture session as per need and examine the
captured protocol with ease. An interesting feature of Packetyzer is the
import/export flexibility which allows it to open packets from a large number of
other capture programs and save packets captured in a large number of formats of
other captured program. With RFprotect mobile, Packetyzer can sniff 802.11
traffic and capture 802.11 packets in promiscuous mode, including control and
management frames. It's a very effective tool for network professionals for
troubleshooting, analysis, protocol development and to handle security threat
better.

WiFi: Commview

Commview is a wireless network monitor and analyzer for 802.11 a/b/g
networks. It captures packets on-the-fly and provides critical information such
as list of access points and stations, per node and per channel statistics,
signal strengths, protocol distribution chart etc. All of this information helps
a network administrator to find out network problems, view and examine packets,
troubleshoot software and hardware.

Packets can be decrypted utilizing user defined WEP or WPA-PSK keys. The
convenient trees like structure display of protocol layer and packets' headers,
which help to determine details of a packet. One can view details of IP
connections like IP addresses, ports, sessions etc. It provides you with an
option to reconstruct TCP session. You can configure alarms that notify about
important events, such as suspicious packets, high bandwidth utilization,
unknown addresses, rogue access points, etc. You can browse captured and decoded
packets in real time. A log can be maintained for individual or all packets in a
file. One can also monitor the bandwidth utilization and can search for specific
string or Hex data in captured packets. There is also an option to view protocol
pie chart.

Overall, this is a very effective tool for IT administrators for monitoring
wireless networks.

WiFi: Kismet

Kismet is a wireless network detector, sniffer and intrusion detection
system. It works with any wireless card that supports raw monitoring mode (rfmon)
and can sniff 802.11a/b/g traffic. It identifies network by passively collecting
packets and detecting standard named network. It also can detect hidden networks
and can gather the presence of non-beaconing networks via data traffic. One of
the key features of Kismet is Ethereal/Tcpdump compatible data logging. It also
has built in channel hopping and multi card split channel hopping. The
client/server architecture allows multiple clients to view a single server
simultaneously. Its also has support for distributed remote drone sniffing. For
known networks, it can do runtime decoding of WEP packets. Its can multiplex
multiple simultaneous capture sources on a single Kismet instance. Graphics
mapping of networks is also available.

Under streams option HTTP Analyzer shows


the amount of data sent on the left and data

received on right window

HTTP traffic: HTTP analyzer

HTTP analyzer is a sniffer, which monitors and inspects HTTP/HTTPS traffic in
real time. It can trace and examine various information ranging from header,
content, cookies, query string, post data, request/response stream to
redirection URLs. Along with several filtering options, it provides Cache
information and Session clearing as well as HTTP status code information. You
can even handcraft a HTTP/ HTTPS request. Using drag drop option you can move an
existing request from the Session grid to the Request builder to execute it
again.

The HTTP analyzer automation library is packaged as COM components and can be
fully controlled by using OLE automation. It displays Winsock traffic
originating from Java applets and Java script embedded in Web page and also
displays Winsock traffic originating from ActiveX controls and COM objects

instanced by an application. It also allows viewing and editing of binary files
in Hexadecimal and textual format using Hex viewer. One can selectively clear
cache and cookies.