How to know if network traffic is OK or not ?

Hi, now I'm in charge of the LAN where I work.... I know a little bit about protocols and packets, layers, etc... but we want to know if there is over-traffic on the network or lost packets... well i'm not sure, everything that is wrong.

I have read that I can do this with Ethereal.... and I downloaded it, but I have no idea what to do with the information that it captures.

Could you help me ? or at least give me some URLs to read about this.

Thanks!
blueshaolinAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Rob WilliamsCommented:
Since you are not sure what you are looking for rather than creating filters you might be best to just make a capture and one by one remove the traffic you know is OK, then analyze what is left. To do so right click on a line with a known protocol, such as SMTP and choose "apply as a filter" and then "not selected".

There is a problem with using Ethereal. If you are connected to a switch, you will only see the traffic between you and the switch. If you have a managed switch you can mirror a selected port, or you can install an old basic hub between the switch and source (such as Internet) and plug into that. Hubs broadcast all traffic to all ports.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Fred MarshallPrincipalCommented:
Without doing a big study project, you might consider getting some empirical experience.
Hook up a couple of computers on a hub (a hub, not a switch, just to make sure you see all the traffic).  Run Ethereal on one of them and see what happens when you PING and so forth....
Try it with compatible IP addresses.  Try it with incompatible IP addresses.

If you see something you don't understand then direct a bit of research to that topic - like ARP perhaps.

You say "everything that is wrong" .... is there a specific problem?

One manifestation of over-traffic would be lots of messages coming out from a single source and with no apparent reason.  That might suggest a parasite.  Certainly if the messages are running through all likely IP addresses one after another!
0
Rick HobbsRETIREDCommented:
Before you start looking at the traffic I would recommend looking at the systems on the network.  Make sure you have a good Antivirus and Anti-spyware software package in place (like Symantec Antivirus Corporate V10.1.5.5000) and run a full scan on the servers and workstations.  Generally eliminating all viruses, spyware, and adware is a major benefit and eliminates excessive traffic.   Also, a Software Restriction Policy (SRP) can help eliminate traffics from games, streaming media and the like.
0
Rob WilliamsCommented:
Thanks blueshaolin.
Cheers !
--Rob
0
Rick HobbsRETIREDCommented:
Thanks!.  Hope I was of some help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.