EXPERT RESPONSE
There are quite a few different monitoring tools available. My advice would be to start with a couple of open source tools before buying a commercial product. If you use Linux consider checking out Wireshark (Ethereal). This free network analyzer is one of the most well know and powerful. It can provide you with a wide range of details of network traffic. Another interesting tool to examine is Etherape. It is a great graphical network monitor.
One good way to get both of these tools up and running quickly is to download a copy of Backtrack. This is one of the newer bootable Linux distro's that literally places hundreds of security tools at your fingertips. Once loaded on a CD, you simply reboot the computer and have everything you need right at your fingertips. If you are looking for something you can run on a Windows system Ethereal will work there too. Another choice would be Packetyzer. It's based on Ethereal and has a great interface with lots of features.
One final word of advice would be to remember that when using these tools, you are limited in what you see on a switched network. You will need to span a port or perform mirror to see a true picture of what's going on. Cisco has an article on the topic, Configuring the Catalyst Switched Port Analyzer (SPAN) Feature, in case you need help with this.
|
