I'm looking for monitoring tools plus protocol analyzers. I need to know which parameters should be taken into consideration, and then I will analyze the tool accordingly.
Requires Free Membership to View
There are quite a few different monitoring tools available. My advice would be to start with a couple of open source tools before buying a commercial product. If you use Linux consider checking out Wireshark (Ethereal). This free network analyzer is one of the most well know and powerful. It can provide you with a wide range of details of network traffic. Another interesting tool to examine is Etherape. It is a great graphical network monitor.
One good way to get both of these tools up and running quickly is to download a copy of Backtrack. This is one of the newer bootable Linux distro's that literally places hundreds of security tools at your fingertips. Once loaded on a CD, you simply reboot the computer and have everything you need right at your fingertips. If you are looking for something you can run on a Windows system Ethereal will work there too. Another choice would be Packetyzer. It's based on Ethereal and has a great interface with lots of features.
One final word of advice would be to remember that when using these tools, you are limited in what you see on a switched network. You will need to span a port or perform mirror to see a true picture of what's going on. Cisco has an article on the topic, Configuring the Catalyst Switched Port Analyzer (SPAN) Feature, in case you need help with this.
This was first published in February 2007