Network Traffic

[mikeleahy]

hi

one of my customers has satellite broadband. Their upload limit has been brought down to 8 kbps. There is no virus on the network and it is not an open relay system for spamming. all the isp say is that there is huge traffic on the line. how can i find out where the traffic is originating on the lan in order to stop the problem???? please help

 

[cyberspace]

download and run a program on the network called ethereal, which is a network protocol anaylyzer.

you can get that here >

http://www.ethereal.com/download.html

You will be able to see all traffic accross the network

Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[mikeleahy]

hi

but how will i be able to tell which pc is causing all the extra traffic??

 

[cyberspace]

ethereal will show the source IP and associated MAC address.

DO they have a static IP scheme or are they using DHCP?

For example, The network I manage is static, with 28 users - I have documented all IP addreses and who they are associated to, for quick reference.

However, If the username is used for the host name of the PC, you could run an nslookup command in a command prompt for the IP address from which the traffic is being generated, which will resolve the IP address to the host name.


Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[jimbopalmer]

Angry IP scanner can give you a table of IP and MAC addresses with machne name and user name

http://www.angryziber.com/ipscan/

I tried to remain child-like, all I acheived was childish.

 

[mikeleahy]

they are using static ips. thanks for your help, when i run the program and i get a load of stats i have trouble reading the info. will it display the pc with the most traffic ?? or what ?? by the way do you think a BSc in network computing is worth doing , i am MCSE and CCNA, going for CCNP but dont have a BSC, do u think its worth it or would the CCNP be more valuable

 

[cyberspace]

Well, you could say sort it by "source" and see if there is any IP that is standing out.

Of course, if you are unfamiliar with the program then it is difficult to interpret because it literally captures every single packet on the network unless otherwise specified - thats alot of packets!

To bo honest, I personally feel that my CCNA training will be more beneficial overall in my career as and when I graduate, and I do want to progress to CCNP or something at that level that is maybe more specialised such as CCSP.

My degree contains a load of programming which I do not enjoy, but next year there is much more in the way of networking, as we do a network management module for the whole year, aswell as a telecomms module.

It certainly can't be bad having the BSc to your name however, but in the field, experience counts more than a piece of paper, and if you are wanting a career in networking then the cisco qualifications are probably the most beneficial.

Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[tylerdurdan66]

I tried Ethreal(?) and didn't like it, the tried lookatlan it is a lot easier to understand.

http://www.lookatlan.com

 

[mikeleahy]

yeah thats what i think myself. i have a higher certificate in IT and then the certs. but this year i was going to go back to do the degree at night but i have now decided to go for the CCNP instead. all the job adverts look for experience and the certs. thanks for your help anyway

 

[cyberspace]

Absolutley - I was just lucky that the CCNA training is actually a part of my degree program, so I get the best of both worlds!

I'll check out look at lan

Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[minxca]

Can you check from your Firewall log? Or from Ethereal you can see what port the PC is using. Usually P2P software generate most traffic.

Certification? Is good if you work for big company, consultant or apply for job. I passed my CCNA while I was taking the course and I used it only once. Yes, when I applied for my stage.

 

[minxca]

I used this simulator software for practice:

http://www.boson.com/netsim/

 

[mikeleahy]

winoto, i didnt think about the firewall log ,i will try that. what is p2p software???

there are no automatic updates or anything turned on . only 1 pc downloads the antivirus update and the rest run the .exe

 

[mikeleahy]

the ccna is not too bad if you study. it took me a few months to do it. and i do use the cli stuff in my job. ccnp will be a lot tougher id say. a simulator will do for the ccna

 

[cyberspace]

P2P software is for file sharing, such as Kazaa etc.

Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[mikeleahy]

can i just remove it as per normal???

 

[cyberspace]

Yeah, if you know what the program is!

Systems Administrator
BSc Network Computing, CCNA. Both in training!

 

[KiscoKid]

By the way, if you have a Cisco router just go into LAN interface configuration mode on the router and type 'ip accounting output'. This will keep a record of all the users that are using the router and keep track of how many bytes each of them are downloading.

Let it run for .. a few hours?.. and when you return you'll have nice stats available and you'll easy see who your top talkers are by using the 'show ip accounting' command.

If you don't have a Cisco, you're probably looking at a network probe, like some of the previous posters have suggested.

HTH