Setup Linux server to monitor network

The switch only sends traffic over a port if it is destined for that port, based on arp mapping.  You need to use a switch that has a sniffer port or configure your port as a sniffer port.  This will send everything to that port for that very purpose.  I have never used a 3com switch so I don't know if they have that ability.

Which kind of 3COM switch do you have, there are a lot of 3300 varities and each one has diffrent features. As for software, there are a lot of great free programs that will run in Linux. I have posted a website below that shows just some of the options you have. I would decide what to used based on the information you want to monitor.

http://www.slac.stanford.edu/xorg/nmtf/nmtf-tools.html#capture

"Which kind of 3COM switch do you have, there are a lot of 3300 varities and each one has diffrent features"

3C16980A Super Stack 3

sorry baout that.

mld4165

So if have this setup right I can hook the Linux box with NTOP or Ethereal into the analysis port and then set another port to be monitored, which will be the only port monitored, and not the whole switch. Correct?

Since one port goes to the router I can see all out bound traffic and broadcasts, but if I want to see internal traffic I would have to monitor another port? Possibly the uplink to the rest of the building, but not both at the same time?

I am not sure but this does not seem to do what I wanted, but that might be my problem because of equipment or my choice of software?

thanks
mld4165

What will happen is the switch will send all the data on the switch directly to your monitoring port. This will allow you to see everybodys network traffic. Anything passed through that switch will show up in your Linux box's ethereal. If you only want to see a specific user or port, I suggest filtering by MAC adress with ethereal.

Re-Reading your post above I think you may be confused by the monitoring port. When you set the monitoring port this does not mean you are monitoring only that port. It means you assigned a port on the switch which will basically transmit all data on the switch. If you plug you Linux box into this monitoring port, you will be able to see every piece of network traffic it deals with.

quoting 3Com documents for this switch

==============================================
Roving analysis is a system that allows you to attach a network analyzer
to one port and use it to monitor the traffic of other ports in the stack.
The system works by enabling you to define an analysis port (the port
that is connected to the analyzer - "MY LINUX BOX IS HERE"),
and a monitor port (the port that is to be monitored - "PORT TO ROUTER").

Once the pair are defined, and you enable the system, the
stack takes all the traffic going in and out of the monitor port and copies
it to the analysis port.

Roving analysis is used when you need the functions of a network
analyzer, but do not want to change the physical characteristics of the
monitored segment by attaching an analyzer to that segment.
==============================================

and that is what it seems to be doing. not showing all traffic, but what is on the monitor port.

mld4165

So you have the monitor port set as the one that connects to your router, and you still can't see all the traffic? Evertime a computer tries to contact another host it's going to go to the router to determine where it should go from there. That means you should see every bit of traffic on that switch.

kamichie

this seems to be working. ntop seems to do what I need and is much easier then ethereal, as ethereal shows so much it is confusing for someone with my level of expertise.

thanks for your help
mld4165