[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 433
  • Last Modified:

Finding network traffic issues

hi all,

   I'm working on a location that has high speed and they are experiencing about 20GB in traffic every night.  they have two wifi routers that are secured and the passwords have been changed.  is there a program that can determine who is initiating the traffic?

thanks Zack
0
zack4x4
Asked:
zack4x4
  • 4
  • 3
  • 2
  • +1
3 Solutions
 
mds-cosCommented:
Yes.  The most complete would be a network sniffer.  It will grab all packets as they come by, allowing you to fully analyze network traffic patterns and allow you to closely examine specific packets or conversations.

Depending on the router, you may also be able to turn on logging to get basic traffic information.  Spool the log out to a tftp server and you can get good history.  Of course, digging through router logs is not for the feint of heart on busy routers!
0
 
BeartlaoiCommented:
The problem with using a program is that it can usually only see what traffic comes into the computer on which it runs.
If the excess traffic is hitting a particular computer then run WireShark, NetMon, NetCap or any other network packet capture program on that computer.

If you are trying to catch traffic say from someone watching HD video on their tablet using your router then one of the above programs probably wont work since that traffic is not going through one of your computers.

There is a way, if you use a hub (not a switch) between your router and your internet provider, and attach a computer with a capture tool in promiscuous mode to it then you can capture everything.
0
 
BeartlaoiCommented:
Or If you are using enterprise class switches then there is usually a command that will allow you to echo traffic from one port to another.
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 
zack4x4Author Commented:
Thanks for your suggestions!  Does anyone have a model of hub I could buy that will work?  I have a dlink dap-1522.  Will that work?  Then to elaborate I would plug the two wifi routers into this hub then into the ISP modem?  

Also would I see the originating IP or MAC address of the PC causing all the traffic or just the IP address of the router the offending PC is hooked up to?

Sorry I'm kind of a newb figuring out this issue but we're loosing a lot of bandwidth.

Thanks!
Zack
0
 
Craig BeckCommented:
You'd need a managed switch for that and it could be expensive just to log traffic.

Can you create block and allow rules on your routers, then log all traffic to see who's doing what after hours?
0
 
zack4x4Author Commented:
i will have to check. thanks for that suggestion will let everyone know.

i tried wireshark in multiple ways weigh my pc plugged in on the router and the docsis modem but i was only able to pick up certain traffic.
0
 
mds-cosCommented:
I do not mean to disparage you, but I should point out that analyzing network traffic and correctly interpreting the results is fairly complex.  If you do not fully understand why a hub is different than a switch in regard traffic flow, and why a hub or port replication are necessary for traffic analysis, you are going to find that much of the traffic running across the wires can be daunting to distinguish.

I am not at all saying you should not proceed.  I firmly belive any educational experience is well worth the effort and time!  I just want to be sure you are giong in to this thing understanding that the answer you seek is probably not going to just jump out when you plug the tool in.
0
 
zack4x4Author Commented:
That may be but it's usually because people use switch, hub and router interchangeably.  I have an unmanaged netgear switch and a dlink router, but if it has to specifically be a hub I need to buy one of those.
0
 
mds-cosCommented:
Network engineers never use those terms intrechangably, as they work very differently.  While the pieces themselves may be interchangable in most simple networks, the technology is quite different.

To your question, any hub will work.  You just need to get the sniffer on the line so that it will be able to see all traffic passing to the router.  Some routers have features that will allow you to monitor traffic as specific ports.  Basically any enterprise-class managable switch has features allowing you to monitor traffic at specific port or groups of ports.

Some switches are actually a cross-breed of switch and hub (group switches), which also work for the purpose at hand.  These type of switches are not so common anymore.
0
 
zack4x4Author Commented:
sounds good i will track down something that week hopefully work.  thanks everyone for your help!
0

Featured Post

The Growing Need for Data Analysts

As the amount of data rapidly increases in our world, so does the need for qualified data analysts. WGU's MS in Data Analytics and maximize your leadership opportunities as a data engineer, business analyst, information research scientist, and more.

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now