network tools

[Erik Nørgaard]

Chris wrote:
> Why don't the numbers support the experience? We have 1Mb/s download and 
> 128K upload (telewest cable). In theory even between us we weren't using 
> all the bandwidth.
> 
> If I put a FreeBSD NAT/router box between the cable modem and the LAN 
> what console based tools should I put on it to examine what's happening?

You want:

snort for packet sniffing and analysis
nmap for scanning your network to see if someone is running wierd apps.

You may want to configure your firewall with pf and queuing so limewire 
etc doesn't eat it all up. With pf, you can also monitor the state 
table, and you can also log suspicious traffic or traffic that causes 
problems. You need to use tcpdump to read the logfile.

IIRC, ethereal is a server/client program where the server runs on the 
trusted host where you want to monitor the traffic. It is good for 
getting the big picture of what is going on. Also, take a look at 
nagios. I have to say that I haven't used ethereal or nagios at all.

Cheers, Erik
-- 
Ph: +34.666334818                           web: http://www.locolomo.org
S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt
Subject ID:  A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22:DE:4C:B9
Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73:25:67:C2