Welcome to ISAserver.org

Free Network Monitor

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 Misc.] >> Tips & Tricks >> Free Network Monitor

Page: [1]

Message

<< Older Topic Newer Topic >>

Free Network Monitor - 8.Apr.2002 9:32:00 PM

spouseele

Posts: 12826
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hey guys,

if you are looking for a free Network Monitor, have a look on Ethereal. Ethereal has a decode for the Winsock Proxy messages (firewall client). Moreover, there is also a plugin available for decoding the H.323 protocol.

Check out:
- http://www.ethereal.com/
- http://winpcap.polito.it/
- http://www.voice2sniff.org/

It is very enlightening to see how the Firewall client actual talks to the ISA server. "[Smile]"

Have fun,
Stefaan

Post #: 1

Featured Links*

RE: Free Network Monitor - 14.Apr.2002 10:14:00 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Stefaan,

Thanks for the GREAT tip! Ethereal is really cool [Big Grin]

Thanks!

Tom

(in reply to spouseele)

Post #: 2

RE: Free Network Monitor - 8.Nov.2002 5:28:00 PM

wdPatterson

Posts: 12
Joined: 8.Nov.2002
Status: offline

Ethereal is da bomb! I use it as THE main troubleshooting tool for ISA. I was able to diagnose all kinds of problems - like a request that does not answer for 3 min (resulting in ISA closing the connection)

It's free....simple...and tres cool. I even clued Microsoft into it.

Best of all, when the MS code jockeys insist on getting sniffs in Network Monitor format, you sniff with Ethereal, save it as a NetMon2 file, and send it along. Works just fine.

Ethereal takes tcpdump file generated by Unix, Linux, and even OpenVMS machines and translates them to NetMon or anything else you want.

You GOTTA get it. [Eek!]

(in reply to spouseele)

Post #: 3

RE: Free Network Monitor - 9.Nov.2002 8:32:00 AM

zzz343

Posts: 762
Joined: 19.Feb.2002
From: World's 7th Nuclear Power
Status: offline

Very Professional utility. Usefull to diagnose problems. and to c inside wht is moving accross network [Wink]

(in reply to spouseele)

Post #: 4

RE: Free Network Monitor - 9.Nov.2002 11:05:00 AM

spouseele

Posts: 12826
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hey guys,

you bet! Everyone who is serious about networking and firewalls should have that tool on board.

Thanks,
Stefaan

(in reply to spouseele)

Post #: 5

RE: Free Network Monitor - 23.Nov.2002 6:05:00 AM

Arpophyllum

Posts: 22
Joined: 9.Nov.2002
From: Bellevue, WA
Status: offline

Ethereal is like having a hex-to-English translator. It's made a number of problematic protocols/applications a great deal easier to decipher.

(in reply to spouseele)

Post #: 6

RE: Free Network Monitor - 8.May2003 9:04:00 AM

tarasbredel

Posts: 175
Joined: 9.Apr.2003
From: Denmark
Status: offline

Can Ethereal be run on a workstation and still monitor the ISA?
Or does it have to be installed directly on the ISA?

Thanks!

(in reply to spouseele)

Post #: 7

RE: Free Network Monitor - 8.May2003 10:08:00 AM

DCawthorn

Posts: 5
Joined: 1.May2003
From: Perth, Australia
Status: offline

the library that ethereal uses for packet capturing appears to support remote capturing...

"WinPcap 3.0 comes with Remote Capture capabilities. This is an highly experimental feature that allows to interact to a remote machine and capture packets that are being transmitted on the remote network."

taken from //winpcap.polito.it/docs/man/html/group__remote__help.html

Hope this helps [Wink]

(in reply to spouseele)

Post #: 8

RE: Free Network Monitor - 8.May2003 10:33:00 PM

spouseele

Posts: 12826
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Taras,

yes! You need to take a capture in promicious mode. Of course the Ethereal host should see all the traffic. Therefore, he should be sitting on the same segment 'shared' by a hub, not a switch.

However, on ISA server itself you can use also the buildin Network Monitor tool (W2K server feature) and import the traces in Ethereal for further analyzes.

HTH,
Stefaan

[ May 08, 2003, 10:37 PM: Message edited by: spouseele ]

(in reply to spouseele)

Post #: 9

RE: Free Network Monitor - 8.Jul.2003 2:22:00 PM

wdPatterson

Posts: 12
Joined: 8.Nov.2002
Status: offline

Yeah, Me again. Some experiences with Ethereal:

1. IF your INTERNAL NIC card is connected to a HUB, then your workstation on the same hub MIGHT be able to see it, but only if the speeds are the same (both the ISA NIC and the workstation NIC) and you are capturing in promiscuous mode.

2. Ethereal will NOT work if you are trying to go into your ISA box with Terminal Services. In thta case, you have to use tethereal (comes in the same package) and dig around a little bit to make sure you are capturing off the correct NIC card. Here's a piece of code I use:
===============================

code:

  
rem Ensure the following strings are set for your machine!
rem Every adapter is unique!

SET  Inside=\Device\Packet_{F3302A50-97CF-4EEC-AC5D-71DDDA4DD6CA}
SET Outside=\Device\Packet_{A1B99062-0754-4974-B396-B5055B37E757}

@Echo Off
rem Ensure you include a quoted filter expression!

C:\FreeWare\Ethereal\TEthereal -i %Inside% -pnl -f %1 %2

%1 is usually the filter string like "host 10.1.3.4"

%2 is the location of the capture file "-wBogus.cap"

Where do I get the values for inside and outside? I run the following in a command prompt window:

code:

 tethereal -D

This will dump the codes for all adapters....then you have to hunt and peck to figure which one is which.

Hope this helps!

(in reply to spouseele)

Post #: 10

RE: Free Network Monitor - 9.Jul.2003 12:26:00 AM

spouseele

Posts: 12826
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi wdPatterson,

some comments:

1) if you are using a real hub, then the workstation should always see the traffic when capturing in promicious mode. A so called dual speed hub is not really a hub. Between the 10 and 100 Mbps internal segments there is a little switch. [Big Grin]

2) on ISA server itself I always use the buildin Network Monitor and analyze the capture with Ethereal.

HTH,
Stefaan

(in reply to spouseele)

Post #: 11

RE: Free Network Monitor - 14.Jul.2003 10:28:00 AM

rhouziaux

Posts: 1
Joined: 19.Apr.2002
From: Belgium
Status: offline

I'm using ISA at home on a Win2k server that is also DC for my small personal domain.
The external connection is provided trough a dial-up PCI ADSL Card using PPPoE.
I'm aware that this is not a correct configuration but it works fine and fulfill my personal needs for the moment.

However I'm experiencing some problems with my home banking application.

I'd like to know precisely how to use a network sniffer to troubleshoot these problems and at least give a useful information to the helpdesk of my bank.

I tried to Sniff the traffic with Netmon but I didn't capture even one single packet of the external traffic.

Could somenone explain me how to setup the Winpcap driver to succesfully capture this traffic on the ISA server. First or all is it safe regarding the stability of my server ?

Thanks a lot for the help

(in reply to spouseele)

Post #: 12

RE: Free Network Monitor - 25.Oct.2004 11:36:00 AM

soket

Posts: 30
Joined: 20.Aug.2004
From: Malaysia
Status: offline

I have install the Ethereal but I don't know how to use it, can somebody help me.
Thanks.

(in reply to spouseele)

Post #: 13

RE: Free Network Monitor - 26.Oct.2004 8:29:00 PM

husker

Posts: 5
Joined: 26.Oct.2004
Status: offline

If you like Ethereal (and who doesn't?) you'll LOVE Packetyzer, a GUI front-end for Ethereal. Makes rules sets and decoding even easier.

(in reply to spouseele)

Post #: 14

RE: Free Network Monitor - 26.Oct.2004 9:26:00 PM

spouseele

Posts: 12826
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi husker,

the Ethereal has already an excellent build-in GUI! [Wink]

HTH,
Stefaan

(in reply to spouseele)

Post #: 15

RE: Free Network Monitor - 27.Oct.2004 5:26:00 PM

husker

Posts: 5
Joined: 26.Oct.2004
Status: offline

Yes but the packet capture filters are a PAIN to setup. You have to know libpcap syntax, and I don't have to use Ethereal frequently enough to remember it! Packetyzer makes filtering SO much easier.

(in reply to spouseele)

Post #: 16

RE: Free Network Monitor - 31.Oct.2004 4:27:00 AM

Guest

If you want a network monitor with easy filters(actually, its pretty easy in all ways) check out lanraptor.
http://www.shakti-software.com/

(in reply to spouseele)

Post #: 17

RE: Free Network Monitor - 7.Nov.2004 4:44:00 PM