[cheaseeater]

Guys, I have a question about the Windows Network Monitor.

Does it really only work for Windows 2000? I've installed the components to run it in XP, but it doesn't seem to be there. Is there a way to monitor my home network (packets in/out, ports, etc.)? I know there are a lot of programs online, but many of them seem to only monitor the ethernet port on my computer. What is a good free program to use?

 

[cgesicki]

http://www.wireshark.org/

 

[JohnWill]

Note that any network monitor will only monitor traffic your system can see. If you have multiple computers connected to either the router's switch ports, or even a separate switch, you'll only see broadcast traffic and traffic routed to/from that specific workstation.

If you need to see all the network traffic, using SOHO components, here's one solution. Connect ALL the computers to a hub (not switch) and connect a single cable to the router. That will impact network performance for multiple stations doing simultaneous transfers, but you will see all the traffic to all workstations. I keep a couple of 8 port hubs in the closet for this purpose.

 

[cheaseeater]

Does this mean I can't monitor wireless clients connected to the router?

 

[cheaseeater]

Note that any network monitor will only monitor traffic your system can see.

How exactly can this computer see another computer's network adapters then?

 

[JohnWill]

Does this mean I can't monitor wireless clients connected to the router?

Correct, the wireless client traffic directly to the Internet will not be visible at the router's LAN switch interface.

 

[JohnWill]

How exactly can this computer see another computer's network adapters then?

Broadcast packets go to every station on the network, which is how computers "find" each other. After that, the addressed packets only go to the computer they're addressed to if you're using a switch.

 

[cheaseeater]

So it's possible to monitor traffic on everyone using my router? How does someone set this up without using Microsoft Network Monitor?

 

[JohnWill]

Actually, it's not really possible without a bit of work. The wireless transactions either between the Internet and a wireless station, or between two wireless stations, don't show up on any of the other switch ports. It is possible to tap in between the router and modem and monitor Internet activity.

 

[cheaseeater]

Actually, it's not really possible without a bit of work. The wireless transactions either between the Internet and a wireless station, or between two wireless stations, don't show up on any of the other switch ports. It is possible to tap in between the router and modem and monitor Internet activity.

Hm. What do you mean by work? Can you explain to me how it would be done?

 

[JohnWill]

You'd need a hub between the modem and the router, then you'd connect a machine to that hub. You'd also need to manually configure the machine's IP address, since you'd be hanging outside the router's internal network address range.

 

[cheaseeater]

What do you mean a hub between the modem and router? There's a wireless cable box, and the ethernet cable from that would be plugged into a hub which plugs into the wireless router?

The wireless router has ethernet ports too so it can provide ethernet local area connections... So I would need to get a hub or something?

 

[JohnWill]

If you have a modem/router combo, you obviously can't do that.

 

[cheaseeater]

Huh?

You can only monitor network usage with a Ethernet switch thing?

 

[JohnWill]

I think you need to understand how a switch works. Addressed packets only to to the addressee, not to all the ports on the switch. Since the wireless switch is internal to your router, you have no way to tap into the connection between the switch and the router.

You can't monitor traffic that never comes to the machine doing the monitoring.

 

[cheaseeater]

Okay now I get it.
So the router is the one handling the packets and where they're going, is there a way to monitor that?

 

[JohnWill]

Not really. Since the connection for the wireless "switch" is internal to the router/modem, there is no way to stick a monitoring point in the middle. You could listen to the wireless traffic, and also monitor the wired traffic, but it could get complicated.

 

[cheaseeater]

Is there a way to monitor only wireless traffic from one of the wired computers?

 

[JohnWill]

Nope, because you don't have access to that node outside the wireless router. As I said, you can see broadcast traffic, but not addressed traffic.

 

[cheaseeater]

Broadcast means what?