?
Solved

HOW TO MONITOR INSTANT MESSENGING ON A 3COM SWITCH

Posted on 2005-03-16
6
Medium Priority
?
488 Views
Last Modified: 2012-06-27
I have a 3com switch and want to monitor traffice using third party software.  My question is how can I do that with the switch?  I want to be able to monitor instant messenging and web sites and stuff like that.  Could somoene give me instructions on how to set it up or what I need in order to set it up.  Thanks
0
Comment
Question by:Rosen500
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 9

Expert Comment

by:rshooper76
ID: 13556813
If the switch has snmp abilities you can monitor network information about the switch using something like mrtg.  You would not be able to monitor instant messaging and web sites using that, at least not to my knowledge.  However, it sounds like you want a proxy server, which would allow you to do this.
0
 
LVL 10

Accepted Solution

by:
ngravatt earned 1000 total points
ID: 13557377
on cisco switches you can setup port mirroring.  For each port, you can mirror the traffic to your network port and then use a network sniffer program to look at all the traffic on your port.  Also, take a look at this product:

http://ww2.websense.com/global/en/ProductsServices/WebsenseEnterprise/

this product is designed to look at all your network traffic and tell you what websites users are going to.  You can download the free evaluation from the website.  They have instructions on how to setup the software so you can see all your network traffic.
0
 
LVL 1

Assisted Solution

by:Suertreus
Suertreus earned 1000 total points
ID: 13561065
I strongly recommend Ethereal (http://www.ethereal.com)- a free/open source win32/linux packet sniffer with good filtering capability as well as built-in protocol handlers so you can easily monitor AIM (et al) and HTTP traffic, particularly AIM message text and HTTP domains visited.  You would be able to trace the packets to the machine from which they came (by MAC, IP, and optionally DNS addresses) if you're looking to bust somebody =P.  It will capture in promiscuous mode, but that isnt likely to be able to see all traffic on a switched network without some pushing and shoving (I've heard that most switches can be fooled into divulging 'private' information as switching is more for speed than privacy anyway).  In your case I would recommend putting Ethereal on a machine upstream of the clients in question that either retransmits the packets itself (i.e. a box running NAT (iptables/routing & remote access/internet connection sharing host) like I use) or on a machine on a non-switched network (i.e. a hub) somewhere upstream that will see the packets en-route.  If you must opt for the latter note that the packets will be much harder to trace to specific clients if you are so far upstream that there is a layer of NAT between the sniffer and the clients.  Good luck!
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question