Wednesday, November 19, 2008

Network Traffic Monitoring Tools sniffer

Featured Tool: Ping Plotter

Ping Plotter is a marvelous tool that pings and graphs an endpoint and all hops in between. It can be useful in troubleshooting packet loss and latency. What is unique about Ping Plotter is it can identify current problems but can also be watchful of new issues that occur. The current version has multiple alert instances and is capable of sending e-mail, logging to a text file, or playing a wav file for specified parameters.

Another is feature is the graphical representation of packet loss and/or latency. You can see the results over any specified time period. Besides the visual graph inside of Ping Plotter, you can export either raw data or have a screen shots saved at automatic time intervals. All ping intervals are completely customizable and any hop can be graphed along with the endpoint.

The Ping Plotter website includes a tutorials and documentation on interpreting the results. There is also a support forum for the product. Ping Plotter is a very affordable at $15 and is available as a 30 day trial. Several websites that rate shareware have given Ping Plotter high marks. It also received an honorable mention in MCP Magazine. Users at Broadband Reports frequently use Ping Plotter to located poor DSL or Cable connections. Gamers are also concerned packet loss and latency and will find this tool invaluable. The beta version of Ping Plotter will be adding more features and better performance.

In our testing, we used Ping Plotter to ping watch the connection to a low traffic website on the end if a dedicated T1. The time interval was set to 1 minute as not to flood the hops or endpoint with packets. The display interval was set for one hour and an image was automatically saved each hour showing the results graphically. The captured results were surprising to say the least. While the cable connection is very good, it isn't perfect. Future plans will include using Ping Plotter with an FTP program to automatically upload the hourly results for everyone to view.

Thanks to Nessoft, maker of Ping Plotter and Jeff Murri for providing a full release version for testing and review.

Ping Tools

Free Ping - This IP ping software tool allows for visual notification along with Windows Pop Ups to notify you of a downed device.

Windows Status Network Reporting Tool - Simple to configure monitoring tool that provides a webpage of device status. Lacks any alerting features but does run as a Windows NT/2000/XP service.

Servers Alive - Fully mature commercial product that can monitor devices, NT Services and performance counters and includes Netware monitoring. Runs as a service on Windows NT/2000/XP, web interface and multiple alerting capabilities. Free for 10 devices. <$$>

IP Sentry - Runs as a Windows NT/2000/XP/2003 service or network monitoring software package. Web interface, monitors Windows shares and services. Lots of optional plug ins. Free for 2 devices. <$$ - $$$>

WhatsUp - The standard against all others are judged. Full package of monitoring and alerting capabilities. Can monitor services, web pages, up/down dependencies, and runs as a service on Windows NT/2000/XP. It has a web interface that includes multiple levels of security. WhatsUp FT Premium adds Fault Tolerance and application monitoring for Microsoft Exchange and Microsoft SQL Servers to good old WhatsUp Gold. WhatsUp Professional suits larger networks.<$$$>

Network Sniffers

Wireshark - Network protocol analyzer (successor to Ethereal). Free does not mean a product is lacking in features or maturity. This is a full feature packet sniffer that can be used capture traffic in real time and identify everything behind the scenes in network traffic. Filtering, DNS resolution of clients and select between TCP/UDP/ICMP traffic.

Show Traffic - Real-time network traffic sniffer on any given interface. Resolves names to IP addresses. Can be used to identify unwanted traffic. It does not capture traffic for later analysis.

Network Probe - Network monitor and protocol analyzer. Unbelievable tool to identify almost any specific network traffic including peer to peer applications and instant messaging software. Filter by hosts per protocol. You will be surprised at the traffic types on your network.

Web Log Analyzers

IIS Log File Analyzer - Simple interface and reporting capabilities provide information such as number of visitors, NS Lookups of visitors, simple filter, and referrers.

Web Log Expert (Full & Lite) - Support for IIS and Apache Logs. Both versions can identify referring traffic, entry page, page stats, search engines, and traffic by the hour of the day and week. The full version can give detailed error reports, exit pages weekly and monthly traffic and much more detailed reporting and filtering.

Mach 5 Analyzer - This is a solid mature product that offers full reporting capabilities and exporting to Word, Excel, and HTML. Extensive filters and tracking and errors. Supports most log file formats. <$$>

Who's-On - Unlike traditional analyzers while report after the fact, this tool reports access in real time. Track visitors activity, set alerts for exceptions and undesirable traffic. This tool is both useful and addictive. Several versions available including one that runs as a service. Web interface for remote monitoring also available. <$$>

Miscellaneous Tools

CoolMon - This tool can provide information about your system in a transparent pane on your desktop. (My Desktop & Config File) There are a variety of scripts and extensions that do everything from gather the weather to create a webpage of multiple systems. (Think servers!)

VNC - Need to remote control a desktop across the room or across the world? This is a stable product that will run as a service or from a floppy and is available for almost any platform.

Event Sentry - Monitor Windows NT/2000/XP Event Logs with this tool that runs as a service. It send e-mail alerts of events specified by type (Warning, Information...) or as defined by the filter.

GFi LANguard Network Security Scanner - Identify security risks on you servers and workstations. Find unauthorized/unexpected services and shares. The product can be used to push patches and updates to equipment for the first 30 days and for a modest fee after thirty days. The scanning ability continues to work for free forever. <$$$>

Sysinternals - There are a wide variety of tools to assist in management or troubleshooting of Windows systems and servers. The tools are well respected with many of them free.

Directory & File Monitor - This small utility monitors files or directories for changes including add/deletion of files, renaming or attribute changes. Has the ability to log activity to a webpage. Excellent to monitor a server or workstation for unauthorized or malicious activity.

GFi LANguard System Integrity Monitor - Monitor files for unauthorized or malicious activity. It runs as a service on Windows NT/2000/XP and can send e-mail alerts. It is an excellent way to protect your web server.

Who's On Proxy/ISA Server - If you has a Microsoft Proxy or ISA Server, watch the actual traffic in real time. See where your users are visiting at any given moment. Web interface for remote monitoring. <$$>

Netbotz/Rackbotz - Hardware devices to monitor critical system areas. Besides security cameras that can detect motion, there are sensors for sound (fire alarm), moisture, temperature, and airflow. These can be a lifesaver for mission critical equipment. <$$$$>

Helper Applications

Hermes Mail Server - Excellent SMTP/POP3 mail server that can be used to relay alerts from your network monitoring station or tools. The source code is included. It can run as a service on Windows NT/2000/XP.

VNC - Remote control of almost any desktop from anywhere. VNC (Virtual Network Computing) allows you to view and interact with one computer (the "server") using a simple program (the "viewer") on another computer anywhere on the Internet. The software is open source and has been ported to almost any platform ever used. VNC runs a service on Windows NT/2000/XP.

Network Notepad - It should come as no surprise that proper network diagrams are an important tool in monitoring your network. Network Notepad is a freeware alternative to more expensive diagramming programs. Network Notepad is a program for creating interactive network diagrams with user definable management features such as point and click telnet.(I have been using the upgraded versions to the software as well as the second icon pack.)

No comments: