best way to watch network traffic

uselpa · 12-07-2004, 02:25 AM

All,
I have an issue with my network config (random long delais; not systematic, but regular).
As my machines are on a switch, I need to monitor the network traffic on the same machine.
What programs does Slackware provide, which one are used?
Any noteworthy alternatives?
Thanks,
-pu

bathory · 12-07-2004, 03:13 AM

Slack comes with a program named netwatch. I haven't use it though but you can give it a try to see if it does what you want.

-X- · 12-07-2004, 04:30 AM

The best IMHO
/usr/sbin/iptraf

cyber-worx · 12-07-2004, 05:54 PM

iptraf is great for statistics but i you want to quickly see who/what is connecting to your computer id go for netwatch.

cythrawll · 12-07-2004, 06:40 PM

there is a free opensource network sniffer called ethereal, It is tottally awesome. Its the best of it's class.

Also, if you just need a quick view of what is going through a certain machine on a certain interface just open up a terminal and type:

tcpdump <interfacename>

ie...

tcpdump eth0

ringwraith · 12-07-2004, 07:56 PM

if you are looking at different tools to look at ettercap and etherape are fun to play with also.

uselpa · 12-08-2004, 01:19 AM

Ethereal is great, I spotted my problem in a few seconds (slow DNS resolutions, up to 15 seconds). The filter function proved to be extremely useful on a busy machine.
And it is really user-friendly.
Thanks to all, this made me discover other tools I was not aware of.

bejiita · 12-09-2004, 05:41 PM

that sounds fine, but theres another subnet at my job that wed also like to monitor and I dont see how that is possible thru ethereal. is there another app youd reccomend

H2O-linux · 12-09-2004, 06:47 PM

just an FYI,

If you end up with " eth0: Promiscuous mode enabled. " in your " message " log file it is from running afore mentioned programs and not an outside sniffer attempt.

bobby_hawk · 02-15-2006, 06:03 AM

Quote:

Originally Posted by cyber-worx

iptraf is great for statistics but i you want to quickly see who/what is connecting to your computer id go for netwatch.

I like NetWatch 1.0a there is a lot to look at... I wish you could select one IP address to monitor then drill down on what what's happening with that address.

If you have a LinkSys Router you can also go to Status, Local Network, DHCP Client Table and see who's attached to your network.

Bob

JockVSJock · 02-15-2006, 12:49 PM

I would recommend Etherape for its visuals

http://etherape.sourceforge.net/images/

JockVSJock · 02-15-2006, 09:02 PM

Quote:

Originally Posted by bobby_hawk

I like NetWatch 1.0a there is a lot to look at... I wish you could select one IP address to monitor then drill down on what what's happening with that address.

If you have a LinkSys Router you can also go to Status, Local Network, DHCP Client Table and see who's attached to your network.

Bob

I checked out NetWatch, and I like.

thanks

BananaRepublic · 09-10-2008, 02:44 PM

I'm looking for a tool that can tell me how saturated the interface is. Netwatch and iptraf seems great but doesn't seem to tell me how saturated the interface is. I could infer from some statistics, but I want to be able to view a percentage of bandwidth or something like that.

BTW, the Slackware does not have any graphics support except for whatever it was to drive the iptraf and Netwatch and Slackware utilities, so any Xapps are out.

bgeddy · 09-10-2008, 03:44 PM

Quote:

Slack comes with a program named netwatch.

I didn't know about this one - it looks interesting.

I regularly use Wireshark which is very useful - I think that it's just ethereal renamed.