The program installs WinPcap during the setup process so that you can start using the program right away without having to worry about dependencies. When you first start York you will notice that it starts capturing packets right away. Unlike other programs that display everything in a single window, York divides information into multiple tabs.

Data is displayed in realtime, and removed from the listing again after a certain period of time. This basically means that you will always see the latest data right away without having to scroll around.

York divides traffic into five tabs:

• Packets: Displays information about all packets, including the time, source and destination address, port and total packet size.
• Files: Keeps track of files that are downloaded to the computer.
• Passwords: Monitors passwords, usually in the form of cookies, that are written.
• Web Sessions: Lists all open web sessions
• Pictures: Displays image thumbnails of pictures that have been accessed during capturing.

Data is not logged into files by default. You can however open the program settings to select log files on your system that you want the data to be recorded into. The logging options are quite extensive, with options to log passwords, files and web sessions, and packets independently.

It is furthermore possible to switch the network adapter, enable sound notifications for events, or hidden mode which hides the program icon in the system tray. Advanced options include saving packets into a pcap trace file (for later analysis) or enabling a TCPdump filter to capture only specific packets.

The monitoring can be stopped and resumed at any time using the toolbar buttons in the main program window. The same options are also available on a right-click on the system tray icon.

York is compatible with all recent 32-bit and 64-bit editions of the Microsoft Windows operating system. It can be downloaded from the developer website.

The network software works best with either the freely available WinPcap Capture Driver or Microsoft’s Network Monitor Driver. Both driver downloads are linked on the official program page. Users need to have at least one of the drivers installed to make full use of the software.

NetworkTrafficView supports a Raw Sockets method as well which unfortunately is not as reliable as using one of the network monitor drivers.

Some Windows users need to run the network monitoring software with elevated rights. This was for instance the case on my 64-bit Windows 7 Professional PC system, as no network adapter is discovered by the program otherwise.

The program afterwards displays the network traffic in realtime in the application interface. This includes the IP protocol, source and destination address, ports as well as packet information, the process and the total data site transferred.

A click on the stop button pauses the capturing for the time being. A search is provided to find specific items in the listing.

The listings are fully sortable with a click on the column headers. It is for instance possible to sort by process, destination address or data size.

NetworkTrafficView comes with the usual assortment of features, including the ability to create a HTML report and to export the current selection as txt, xml or csv files.

I rarely think that Nirsoft software lacks a feature. This time though I’d like to see a filtering option to filter traffic directly while it is captured. This way you could monitor a specific process or only data packets above a certain size in the interface.

NetworkTrafficView is available for 32-bit and 64-bit editions of the Windows operating system. Windows users can download it and the necessary capture drivers from the Nirsoft website.

The Dude is a professional network monitoring software, available as a stable version and a beta version for the Windows operating system.

Both versions are completely free of charge, offering loads of features.

The configuration of the program usually begins with the addition of at least one network device. Supported are plain and secure connections, on all ports and with authentication if necessary.

network monitoring

The application supports automatic network discovery and layout generation. The computer network is shown on a map after a successful connection. Individual devices are displayed with their IP addresses, names, icons, as well as cpu and disk utilization. Connections are shown with their current bandwidth usage and maximum capacities.

It is possible to add additional networks or devices to the program at any time and link them to the existing map manually or automatically.

A click on a device or link opens detailed information. This includes the MAC addresses, DNS names, types, services, outages information, Snmp, polling or history details and tools.

This section alone is very extensive, and likely very confusing for users who have little to no experience monitoring or managing computer networks.

The left sidebar menu lists available tools and options to manage and monitor the computer network.

computer network

Available are for example services running on the devices in the computer network, access to various log files, files view, Mib Nodes and access to networking tools.

network device view

Feature List

• The Dude is free of charge!
• Auto network discovery and layout
• Discovers any type or brand of device
• Device, Link monitoring, and notifications
• Includes SVG icons for devices, and supports custom icons and backgrounds
• Easy installation and usage
• Allows you to draw your own maps and add custom devices
• Supports SNMP, ICMP, DNS and TCP monitoring for devices that support it
• Individual Link usage monitoring and graphs
• Direct access to remote control tools for device management
• Supports remote Dude server and local client
• Runs in Linux Wine environment, MacOS Darwine, and Windows

The developers have created an online help and pdf version which explains the majority of available features. Users who are still stick can use the well frequented user forum for additional help and support.

The Dude is compatible with 32-bit and 64-bit editions of the Microsoft Windows operating system, as well as Linux Wine and MacOS Darwine. Downloads are provided on the developer’s homepage.

The monitoring software combines monitoring of various PC activities, reports and an alerts and warnings system under its hood. It supports monitoring of websites visited, program launches, web searches, emails sent and received, keystrokes, instant messenger chat logs and screen captures of the computer desktop.

• Every Program launched: when program was started/ended, what is the program name, what is the text in program title;
• Every Web site visited: the web site address, when it was, even the IP address;
• All Web Searches: what was this search for;
• Computer usage time;
• All E-Mails sent and received;
• All Web Mails sent and received on HotMail/LiveMail, YahooMail, Google GMail, AOL Web Mail;
• Instant Messengers chat and conversations via Windows Live Messenger, AOL, Yahoo/ICQ, Jabber, etc;
• All keystrokes typed;
• Record screen captures in color and high resolution with highest compression rate available;
• Total network traffic.

BlackBox Security Monitor displays an add computer wizard on first run which can be used to add the local PC or another PC in the network to the list of monitored systems. The add computer menu is available from the program’s main interface at anytime should the need arise to add additional PC systems. It is furthermore possible to monitor all or only specific users of a system.

blackbox security monitor

The program lists all monitored computer systems and users in the left sidebar. Reports and the getting started page are listed there as well. Selecting a user or computer displays the relevant information on the right side.

Both the user and computer listings display the information in a tabbed interface divided into sections like programs, websites or emails. Date and time are presented on the screen with options to take a look at a specific date or time frame to see the activities during that time.

Several reports can be created after clicking on the reports entry in the left sidebar. Among them options to list the most popular websites, programs and web searches.

• User Activity report;
• 10 Most popular programs;
• 10 Most popular Web sites;
• 10 Most popular searches on the Web;
• 10 Most active Instant Messenger users;
• 10 Most active E-Mail users;
• Program launched report;
• Web sites visited report;
• Alerts/Warnings generated report.

Alerts can be configured to instantly notify a user by email or cell phone on specific activities including program launches, web mails or websites visited.

BlackBox Security Monitor offers enterprise grade functionality, currently for free. The program is available for both 32-bit and 64-bit editions of the Microsoft Windows operating system.

But for those who only need to monitor a few devices, configuring Nagios to do so is actually quite simple. In this article I am going to show you a few configurations to handle and then how to add devices and checks for your installation.

Post-install configurations and plugins

Before you get busy setting up devices for Nagios to monitor, you should first install some extra plugins for the system. Open up Synaptic, search for “nagios” (no quotes), mark nagios-plugins-extra for installation, and click Apply to install. Once that is done you will already have more functionality with Nagios.

Now let’s take care of a couple of configurations. The first is in the /etc/nagios3/conf.d directory. The file is called contacts_nagios2.cfg. In this file you will configure who is to receive the email alerts. The line to set this configuration is:

email    root@localhost

You will want to change that email address. That is it for this configuration file. Now in order for Nagios to be able to send out alerts via email, the machine housing Nagios has to be able to send those alerts out. You can check that by using the mail command like so:

mail email@address -s TEST

Where email@address is an actual address you can use for testing.

Once you enter that line, hit Enter and then type some random text. When you’re done typing hit <Ctrl>d and then Enter. The mail should send away. If not you will have to troubleshoot your mail server (beyond the scope of this tutorial).

Add a device

Figure 1

Now for the good stuff. We are going to add a device to Nagios. The device we will add is a Windows XP desktop to monitor. Within the /etc/nagios3/conf.d directory you will see a number of .cfg files. These are the files Nagios uses to dictate what is see and how it acts upon what it see. For every device you want to use, I find it best to add a .cfg file. So let’s create the file /etc/nagios3/conf.d/windows_xp.cfg. The contents of this fill will look like what you see in Figure 1.

As you can see there are a few directives here. The directives are as follows:

• check_command – The command used to check the status of the device.
• max_check_attempts – How many times will Nagios retry the status check.
• check_period – How often are the checks made.
• process_perf_data – Enable the processing of performance data.
• retain_nonstatus_information – Enable the retention of non-status information across reboots.
• notification_interval – How often are notifications sent to inform the administrator this host is not okay.
• notification_period – How often are notifications sent out.
• notification_options – The options shown are w – send notifications on “warning” state, u – send notifications on “unknown” state, and “r” – send notifications when a service stops flapping (when a service changes frequently).

NOTE: Depending upon the version of Nagios you have installed the notification_options will be different. Some instances will not accept the “w” option. If you get an error, exchange “w” with “d” (for down).

As you can see there are configuration options that will be specific to your devices and networking topology (host_name and address are examples). Once you have created this file save it and restart Nagios with the command sudo /etc/init.d/nagios3 restart command. Now take a look at your Nagios page and you will see the new device you just added.

Final thoughts

Someday someone will come up with an automated way to detect devices in Nagios. Until then we are relegated to adding them using this means. Does that mean you should shy away from Nagios? Not at all. Nagios is a powerful tool ready to help network administrators keep tabs on their network devices.

There are three options on how to stay informed about downtimes. The first two options are managed by the webmaster or system administrator. Online services and computer programs are available to check a website regularly to see if it positively responds to those checks. The third option is a hosting company that does the monitoring for the webmaster.

Karen’s Net Monitor is a website monitor for the Windows operating system that can check websites, email servers and IP addresses.

Two websites are configured on startup that are checked regularly. Websites are displayed with a checkbox that indicates if they are being monitored. A check log is displayed at the bottom of the main screen as well as overall stats and stats for individual jobs that are selected.

The testing interval can also be configured in the screen.

New websites and properties can be added by clicking on the Edit Settings button. Here it is possible to add new websites, email servers and ping checks.

The program has no options to test services that run on a web server or to check responses on a site. A common check in many monitoring programs is to see if a previously defined text is returned on the website or server that is being checked.

Karen’s Net Monitor can be used for basic network monitoring tasks. The program is compatible with 32-bit and 64-bit editions of Windows and available for download at the developer’s website.

The program is different from most computer monitoring applications as it sits quietly in the system tray until a value climbs over specified parameters. These are then shown as overlays on the Windows desktop giving the user a direct indication of the processes or hardware that is causing the increased usage of computer resources.

The values that are monitored can be configured in the program’s options. These can be reached by right-clicking the system tray icon.

The options are divided into two sections. The data is by default displayed in three panels with the possibility to remove panels from being displayed and moving so called prisms, which are the hardware, software and processes that are monitored around so that they are displayed in different panels.

Available prisms are cpu, memory disk, network and processes of which all but the first are divided into further sub-prisms. The process prism is for instance further divided into cpu, memory usage, page faults and IO Kbytes prisms.

Each prism comes with its own options that can be used to configure the thresholds that trigger the display of the prisms on the computer desktop.

Each panel on the desktop can be moved around independently from each other so that all are placed in the exact locations the user wants them to be.

Prism does not use lots of system resources which is surprisingly for a program of its kind. Cpu usage never went above 2 and the memory usage stayed at a steady 7.5 Megabytes of computer memory.

Prism Hud can be downloaded from the developer’s website. It is compatible with most Microsoft operating systems including Windows 7 and Windows Vista.

Other tabs of interest include the Connections tab that is displaying all open connections including the remote IP address, the local port and the program that is using that connection. There is also an option to display UDP listeners, remote computer names and internal connections.

The traffic tab will display traffic statistics of each network adapter in realtime including incoming and outgoing bytes, errors and load. The four last tabs display detailed IP, TCP, UDP and ICMP stats. These are excellent for in depth information about the computer network but usually not that useful to most users.

The information can be copied to the Windows clipboard or saved to disk in a text file. Users who are interested in an excellent lan monitor can find additional information and downloads at the website of the developer of the program.

Three Network Monitor Experts have been released so far, the last less than two weeks ago. Available are the Simple Search, Top Users and TCP Analyzer Experts. Here is a short summary of what these Experts do:

• Simple Search Lets you search frames and comments for raw ASCII text case-insensitively or with regular expressions.
• Top Users Lets you determine the heaviest users of network bandwidth.
• TCP Analyzer This tool analyzes network traces of Transmission Control Protocol (TCP) connections.

The Experts can be downloaded separately and need to be installed before they can be used. It is recommended to close the Network Monitor before installing the add-ons. The Experts become then available in the Experts menu on top of the program.

Microsoft Network Monitor is offered as a free download for 32-bit and 64-bit editions of the Windows operating system.

Fing can be run with a single command from the command line or started in interactive mode which basically consists of a series of questions and simple answers provided by the user. The first question for example after starting the interactive mode is about the mode the software should run in. Options are discovery, scan or infos.

• Discovery: Will start the network discovery module. The user has to pick a network adapter and answer several additional questions. Fing will generate a network discovery report in the end.
• Scan: Provides the means to scan a remote host, will display ports, services and firewalls running on that server.
• Infos: Displays information about local and remote networks.

Fing offers a selection of output formats such as text, html or csv that can either be displayed directly in the console or saved in a file on the local computer system.

Verdict:

Fing is a fast network discovery tool for command line junkies. The export functionality and speed are excellent, a graphical user interface would be desirable nevertheless.

The main interface of the monitoring software is divided into a quick server check option at the bottom which can be used to check if services such as HTTP, FTP or POP are running on a IP or domain. The networking monitoring software will automatically display the results in the same interface. Probably more interesting than the quick check function is the option to add servers permanently to the monitoring tool.

The user needs to enter a server name which is used for identification and a server address which is usually an IP address. A list of services are preselected and will be checked unless unchecked by the user. Alerts can be enabled or disabled in the same interface as well. These do have to be configured separately and can inform the user by email, screen message, executing a program or playing a sound.

There is also the possibility to add http url checks next to the default services that can be monitored by Open Monitor. This allows a user to specify an url, port, alerts and words that the page should include or exclude. This can be used for example to verify that a page is up by checking for a word on that page that is always appearing. Can also be used to run scripts that output a simple message in the end, e.g. a database check that is displaying ok if the database is up and running.

Open Monitor is a straightforward, easy to use, network monitoring software that can monitor popular services. Alternative programs are the server monitoring software IT Service View, Newt, the website monitoring software SiteMonitor or the Microsoft Network Monitor.

Homedale is a portable wireless networking software for the Windows operating system that can probably be best described as a wlan monitor. It uses a tabbed interface that displays information about the local network adapter, the available access points and the signal strength of each access point. The access points tab lists the name and mac address of each available access point plus information about the encryption method (WEP, WPA, WPA2), the bitrates, channels and signal strength.

The wireless networking software can be used to monitor the signal strength of selected wireless adapters over time which makes it an excellent analysis tool especially for small and medium computer networks.

Homedale has a size of less than 300 Kilobytes and uses roughly 5.5 Megabytes of computer memory while running the background. The software developer does not provide information about supported operating systems; It ran without problems on a Windows XP SP3 test system.

An alternative for Windows users is Wi-Fi Signal Strenght. Linux users might want to take a look at Wavemon which can display advanced wireless information.

The wavemon tool is a very handy tool to have in your arsenal that will help you gather information you might not otherwise have. With wavemon you can see Signal levels, Noise levels, Signal to noise ratios, frequencies, TX power, sensitivity (if available), bitrate, and so much more.

One of the only issues that might turn you off of wavemon is that it is an NCurses tool. This means the tool is run in a terminal window (I have found it runs best under Eterm) and uses ASCII to create the information it offers. Don’t let this cause you not to want to use wavemon because it is a very useful tool.

Getting and Installing

Wavemon is downloaded and installed from source. Download the tarball from the Wavemon site and save it to your hard drive. The installation steps are simple:

• decompress wavemon with the command bunzip2 xvzf wavemon-current.tar.bz2
• untar the archive with the command tar xvf wavemon-current.tar
• cd into the newly created directory with cd wavemon-current
• generate the make file will ./configure
• install wavemon with make ; make install
• start wavemon with the command wavemon

Wavemon Info Window

As you can see, in the image on the left, the Wavemon info window offers a lot of information.

At the bottom of the screen you will notice there are 10 possible options (of which some have no entries). Each of these options are different screens you can view.

The list of windows is:

• F1: Info. This is the main window that opens upon start up. This is where you get most of the information from wavemon.
• F2: Level Histogram. This displays a real-time bar-graph of Signal level, Noise level, and Signal-to-Noise Ratio.
• F3: Access point list. This feature has not been implemented yet.
• F7: Preferences. Configure Wavemon.
• F8: Help. Like a lot of Linux applications, wavemon shows the developer has a sense of humor. When you hit F8 for help it displays the message “don’t panic”. That’s it. There is more help by reading the man page (issue the command man wavemon).
• F9: About. Get all the information you need about the current wavemon release.
• F10: Quit.

You can also start wavemon with a few handy options. Those options are:

• -i This will override auto detection and use a specified network interface.
• -l Use linear level scales instead of logarithmic scales.
• -r Generate random levels for testing.

Final thoughts

If you need more information than your standard networking tools offer, and do not want to dump any extra cash into a third party offering, wavemon is just the tool for those looking to know everything there is to know about their networks. It’s easy to use, offers a ton of information, is open source, and has a tiny foot print.

The actual capturing process does not start before the user clicks on the Start button of the application. Another possibility would be to load a previously saved session which can be displayed as well in the interface. The network traffic will be captured continuously until the user decides to stop the capturing process.

Filters can be used to narrow down the results. About 25 default filters are available like filtering by IPv4 addresses but the user can also define his own filters. Each frame is displayed listing the process name, source and destination IP, protocol name and description. Another pane is displaying details about the currently selected frame.

The network monitor runs on Windows XP, Windows Vista, Windows Server 2003 and Windows Server 2008 and is available for 32-bit and 64-bit editions of the selected operating systems.