Port Monitoring Software

Question

Dell once recommended a free port monitor/packet sniffer.  I can't remember the name of it.  I know how to setup Port Mirroring on the powerconnect switch, but need the name of the software they recommended.  Another option would be for someone to recommend a good network monitoring tool (packet sniffer).  I mirrored the port that the internet comes in on from the router.  This way I see all packets for the internet going in and out.  The utility that Dell recommended showed me the ip of the sender and what site they were hitting (ip and sometimes full dns name).  It also gave me at least the ip of the computer (in house) that was accessing the site(s).   Any suggestions?

Shiftaltnumlock · Answer

Dont know what Dell suggested but what you want is EtherReal and WinPCap. The sniffer (EtherReal) is the best out there and it is freeware. WinPcap is the packet capture driver. Go to http://www.ethereal.com to get the sniffer and you will find a link on that page for the packet driver also. If the packet driver link is not there anymore, just google WinPcap. It is everywhere.   Question for you: Can I monitor all activity in my switch stack somehow? I have a stack of two 3348's. If so, How?

doug4772 · Answer

Thanks, for the suggestion.  I googled for awhile yesterday and stumbled across Ethereal and remembered that that WAS what the Dell guy recommened.  Thanks!   As far as monitoring traffic in a stack.  As far as I know, you can monitor all traffic from ONE specific port on a switch.  For example, I have several Dell switches all in a star configuration which all link to a central 5224 Gigabit switch.  The cable for the internet is plugged into the 5224, let's say into port 1.  If I mirror port 1 to another OPEN port on the same switch I can then use Ethereal to see all internet traffic from ALL switches stacked or otherwise.  I hope this helps.   Because of the nature of switching technology, you cannot see traffic on all ports or a switch.  The only way it works is if you want to monitor traffic from all clients to specific device connected to a specific port on the switch.  You just setup a port mirror from that port to an open one as I described above.   -Doug

Shiftaltnumlock · Answer

Thank you for replying. I will try putting the mirror on my internet port and see how well that works. I had hoped to be able to capture traffic that is local also. A few other switches on the market would allow you to mirror a port or an entire vlan. I was hoping that I could mirror the vlan.

doug4772 · Answer

Double check with Dell. You MAY be able to do it through vlans, but I'm not sure.

mattboston · Answer

your monitoring server needs to have 2 ethernets, one is dedicated to the monitoring. then what you do is SPAN the port or vlan you want to be monitored to your spanning port. If the port or vlan you want to monitor is on another switch, you need to do a SPAN of SPANs, basically, you SPAN from one Switch to the one your monitoring machine is plugged into, then SPAN that to the specific port you server is plugged into.

Also, make sure that the ethernet that you are using for monitoring is not your primary ethernet because you will get a ton of network traffic. use this ethernet only for Spanned traffic.

GregG1 · Answer

The PowerConnect switches only support a port-based monitoring/mirroring feature. There is no way to configure the switch to monitor based on a VLAN.   See the 'Defining Port Mirroring Sessions' section of the online User's Guide at the following link for more information:   < ADMIN NOTE: Broken link has been removed from this post by Dell>

Networking General

Port Monitoring Software

Was this post helpful?