Ali Jawad's Portal Site

1. Predict Future Usage Needs

1. Monitor Network Usage and Identify Bottlenecks

1. Identify Users which are slowing down the network or generating tomuch traffic "Take into consideration that if a couple of users access the file server at the same time congestion might occur"
   

1. Identify Computers that have security issues that might compromise the security of the whole network "And Ive been studying security issues of servers, networks and webservers it is quite easy to penetrate a network if a backdoor exists"
   

The tools we need are the following :

• iptraf

1. jnettop

1. ntop

IPTRAF : iptraf is an ncurses-based IP LAN monitor that generates
various network statistics including TCP info, UDP counts, ICMP and OSPF
information, Ethernet load info, node stats, IP checksum errors, and others.

JNETTOP :  jnettop captures traffic coming across the host it is running
on and displays streams sorted by bandwidth they use. Result is a nice
listing of communication on network by host and port, how many bytes
went through this transport and the bandwidth it is consuming.

NTOP : ntop shows the current network usage. It displays a list of hosts
that are currently using the network and reports information concerning
the (IP and non-IP) traffic generated and received by each host. ntop
may operate as a front-end collector (sFlow and/or netFlow plugins) or
as a stand-alone collector/display program. A web browser is needed to
access the information captured by the ntop program.


Ok now we can group the utilities as follows, jnettop and iptraf are
console utilites while ntop is a web based utility. So I am going to
explain jnettop and iptraf and their differences. And then Iam going to
give a brief introduction into ntop.

Jnettop works as follows:

You just execute jnettop as root, and supply a number of arguments as
follows:
-i <interface>
-p i.e. promiscuous mode, this means that the application will display
  all the traffic arriving at the selected interface not just the
traffic intended for it, i.e. the application becomes a sniffer.
x, allows for specification of custom filtering rule, examples below

Examples:
jnettop -i eth0 => Listens to eth0
jnettop -i eth0 -p => Listens to eth0 and displays all traffic arriving
on the chosen interface
jnettop -i eth0 -x  "show 192.168.1.32" "src 192.168.1.32" => This shows
traffic gong from and to host 192.168.1.32 on the chosen interface

IPTRAF works as follows:

Just type iptraf and you will get a menu with the following choices:
IP traffic monitor -> Similar to jnettop main interface
General interface statistics -> Shows all interfaces + the datarate of
both + the total traffic on both
Detailed interface statistics -> Shows A Very detailed and
understandable page about the chosen interface, very informative !
Statistical Breakdown -> No need at Alem for this one
LAN station monitor -> Shows the cumulative traffic for each host on the
network, good tool to see who is using the most bandwidth over a period
of time.

Jnettop VS Iptraf

As you know jnettop is used to see who is using traffic and how much
traffic is being used, however jnettop only show active tcp session this
means that once the session is over we do not know anything about the
host, and if the host has several sessions we do not know the total
bandwidth consumed by that host, all of the mentioned probs are
available in iptraf. However iptraf, does not clearly indicate what
websites are being used, while jnettop does clearly indicate the sites
being visited. Note however that all of the mentioned specs mentioned
are available in ntop, however ntop is a web application and you need to
refresh the page everytime you need want to retrieve updated data. While
 jnettop and iptraf are console applications and display all the data in
real time.

NTOP:


NTOP and MRTG are the best web based network monitoring utilities
around,  ntop is good for one network while mrtg is better for snmp
based WANs. NTOP allows to track over a period of time what the consumed
bandwidth is, who is consuming that bandwidth, on which ports is the
bandwidth consumed. It generates detailed tables and graphs for both the
whole network and every single host on the network. Amongst the info
displayed for single hosts (hostname, IP, mac, OS,bandwidth usage,
security issues). Furthermore, it shows active TCP sessions, and the
sites that were visited lately and the hosts accessed lately and many
more. The graphs and tables are straight forwarded. For any technical
support or help on terminology refer back to me and I am glad to help.



Below are the man pages for IPtraf, Jnettop and NTOP please mahmoud
print them out and get me a copy, they are small :p.

http://manpages.debian.net/cgi-bin/display_man.cgi?id=516241d0358754774afd30e660050951&format=html
http://www.die.net/doc/linux/man/man8/iptraf.8.html
http://www.ntop.org/ntop-man.html

Prepared by Ali Jawad
References: The mentioned man pages.

Only registered users can write comments.
Please login or register.

Powered by AkoComment 2.0!