How can you monitor network traffic?

[Mini-Me]

Hi.

Recently, there has been a-lot of activity on one of the ports of my ADSL router, which is connected to the office computer, which spends most of it's life running, but not actually with a user sitting in front of it.

The lights on the router are blinking flat-out all the time for this port, yet there is no-one in the office.

I have unplugged the office cat-5 cable, as I suspect something is going on in the background.

What I need, is a program which I can run, on any machine on the network, which can monitor the amount of data traffic to any/all workstations on the network, so I can see if something is going on(an invasion from the net by a hacker, for example?)

SOMETHING is going on, as with this port connected, and the lights blinking, the ADSL speed to my main machine is snail-speed, however, with the suspect port unplugged, the ADSL speed returns to my main box.

Now, I know that the ADSL's total speed will be shared across the network between those boxes requesting access, so it's odd that one box is using so much of the bandwidth with no-one using the box...
:rolleyes:

Comments?

[Variable]

Well you can monitor the packets seen by any single machine with a packet sniffer like Ethereal. If the machines are connected by a switch you won't see all the packets flowing across the network except for broadcasts.

http://www.ethereal.com/download.html

Great program to learn how to use. It will help you see exactly what your machine is communicating with. I would download it and install it and then spend an hour or two doing real time monitoring for a few minutes at a time then looking at the packets and googling things you don't understand. It will give you a huge understanding of how things work behind the scenes. It is not for the average user.

[Jiggy]

Can anyone else get on the above site, I downloaded the program but now I cant get back on the site.

[mjc]

Nope...it went down this afternoon.

[jlreich]

Same here...

[Jiggy]

Its back up now.

[deddard]

Ethereal is a great program, but can leave some artefacts when removed (which make the sysem run a bit slower) - Can't remember the details offhand, but I've noticed it a couple of times, as have others here.

Having said that, it is a great program.
If you don't want to put it directly on the PC you are concerned about, you can interrupt the connection to the switch with a hub, put another pc on running ethereal and monitor the problem PC (only suggesting this in case there is any clever malware which will prevent logging correctly)