A Few Questions related to Network Administration and TrafficAnalysis

[Matt Florido]

On Mon, March 7, 2005 1:27 am, Rebel said:
[..]
>
> 2. Lets say I want to administer packets at the router
> level and want to see which packet is going to which
> machine (both to and fro), what tools/tips and
> techniques are recommended for the same.
>

Check into tcpdump and ethereal.  These are essentially packet capture
programs, as is snort.  You can add modules to the latter to make it an
IDS.

You want to make sure you're either on a promiscuous port on a switch, or
connected to a hub.  The reason being, switches don't typically repeat
signals across all ports unless it has the ability to do so (higher end
switches).  Hubs are simply signal repeaters which means nodes connected
to a hub sees packets/datagrams even though the destination is another
node.

-- 
Regards,
Matt Florido