But when you see this error you know that your Nagios installation isn’t able to use any external commands. Fear not, this error is simple to over come, and in this article I am going to walk you through the fix.

Assumptions

Figure 1

This how to will assume that you have a working Nagios installation as well as root or sudo access to your server. This article also assumes you have tried to use features that require external commands. If not, let’s take a look at how.

If you point your browser to your Nagios server, click on the Service Detail link and then click on one of the services (such as HTTP or SSH). On this page you will see the Service Commands box. If you click on one of those links and you get the error – you need the fix!

The fix

Saved by zero right? Sort of. The first thing to check is in the /etc/nagios3/nagios.cfg file. Look for a line like:

check_external_commands=1

If that line is either commented out or set to “0″, change it to look like the entry above. Once you have done that, save and close the file. Now restart Nagios with the command sudo /etc/init.d/nagios3 restart. You’re not done yet.

The next step is to open up the /etc/nagios3/cgi.cfg file. You will most likely find these two lines:

authorized_for_all_services=nagiosadmin

authorized_for_all_hosts=nagiosadmin

After these two lines, you need to add the following:

authorized_for_all_host_commands=nagiosadmin

authorized_for_all_service_commands=nagiosadmin

Save and close this file. Now restart Apache with the command sudo /etc/init.d/apache2 restart.

Still not done. Now you have to make a slight change to /etc/groups. Open up this file, with your favorite text editor, and look for a line that looks like:

nagios:x:127:

Change this line to look like:

nagios:x:127:www-data

Now save and close this file. Almost done. But the next step is a bit more challenging the previous.

In the directory /var/lib/nagios3/rw is a file nagios.cmd. This file most likely doesn’t have the correct permissions set. By default only the user nagios has access to these files. Since we can’t change this to the www-data user (it would break other features of Nagios), we need to just add the executable group bit to the file like so:

sudo chmod g+x /var/lib/nagios/rw

That’s it. Now go back to that Service Commands section and click on one of the links. You should no longer get that error.

Final thoughts

You may have thought your Nagios installation was pretty useful. Now that you can execute external commands, you will find your Nagios install to be far more useful.

This article will assume the box hosting your Nagios installation has a working email server. If not, take a look at my Postfix articles here on Ghacks. Once that is up and running, email alerts are just a few steps away.

Assumptions

Outside of having a working email system, this article will assume you already have a functioning Nagios installation and that you are familiar with its configurations. I will also assume you have gathered all of the email addresses you need to use with Nagios. That being the case, let’s get with the configurations.

Defining your contact

The first item to tackle is to define your contact. This is done with the file /etc/nagios3/conf.d/contacts_nagios2.cfg. In this file you will see a section that looks like:

define contact{
contact_name USERNAME
service_notification_period 24x7
host_notification_period 24x7
service_notification_options w,u,c,r,f,s
host_notification_options d,u,r,f,s
service_notification_commands notify-service-by-email
host_notification_commands notify-host-by-email
email email@localhost
}

Where all text above in bold is user-specific. NOTE: You will want to add a new define for each administrator that needs to be contacted via email. And make sure you define each user with his or her email address in the define.

Before you move on, it would be good to restart Nagios to make sure your definitions are correct. If there is an error you will get a warning in the output of the start command.

Define your contact group

In that same file you will also find a spot to group users together in contact groups. This comes in very handy because you can then define a set of users (administrators) who will only get warnings for certain services or certain hosts.

To define a group add an entry like so:
define contactgroup {
contactgroup_name       web-admins
alias                   Web Server Adminstrators
members                USERNAME1, USERNAME2
}

Where USERNAME1 and USERNAME2 are members for this group. NOTE: the usernames in this group MUST be defined in the define contact section above. If they are not, Nagios will throw errors when it attempts to start.

Attach groups to services

Finally you need to attach your groups to services. As you can see, above, I have created a web_admins group. It should be above that this group should be added to a corresponding service in the file /etc/nagios3/conf.d/services_nagios2.cfg. In this file you will have created an entry like:

define hostgroup {
hostgroup_name http-servers
service_description  HTTP
check_command  check_http
use generic-service
notification_interval 0
}

To this entry you will want to add the line:

contact_groups web-admins

Now when you restart Nagios anytime there is an issue with one of the HTTP servers, only the contact group you have assigned will be notified. Pretty slick.

Final thoughts

I hope you are starting to see just how flexible and powerful Nagios is. If not, don’t worry – there’s plenty more to come!

One cool ability of Nagios is that it allows you to group machines into services. Say, for instance, you have a number of machines that serve as Web servers or Samba servers. Instead of having to scroll around to find them, you can group those machines together, by service, to make for much easier monitoring. In this tutorial I am going to show you how to take advantage of this nifty feature.

Assumptions

I am going to assume that you already have Nagios installed and working. I will also assume you know which machines are on your network and what services they are running. For the sake of this tutorial, we will piece together all machines that fall under the categories: ssh-servers and debian-servers.

Machine-specific .cfg files

The first thing to do is to create a specific .cfg file for each machine you need to add.  This subject was already addressed in the “Easily extend Nagios’ functionality” article. Without these .cfg files, Nagios will not be able to see the machines – this is critical for being able to group machines by service.

Setting up the groups

If you look in /etc/nagios3/conf.d you will find a file called hostgroups_nagios2.cfg (NOTE: The “2″ is not a typo. For some reason the configuration files have not been renamed to reflect the migration from 2 to 3.) This is the file in charge of grouping machines together by service. A typical entry will look like:

# A list of your Debian GNU/Linux servers
define hostgroup {
hostgroup_name  debian-servers
alias           Debian GNU/Linux Servers
members         localhost, Elive, courtney-desktop
}

Figure 1

As you can see I already have three machines grouped together. You can have as many as you like. Now, when you take a look at the Nagios’ Hostgroup Overview, you will see the machines you have defined listed (see Figure 1).

Notice the Host names listed. These names are taken from the configuration you see above. You can’t, however, just edit the names to make them whatever you want. Those names have to reflect the host_name directive in the particular hosts .cfg file. So for courtney-desktop above you might find a courtney_desktop.cfg file containing the line host_name courtney-desktop.

Now, do the same for all of your SSH servers, by adding in any hosts that serve up ssh to clients. It’s done the same way. In the /etc/nagios3/hostgroups_nagios2.cfg file you will all all hosts to the ssh-servers section.

Once you have added all your hosts to your groups, you have to make sure you restart Nagios in order for the changes to take effect. Do this with the command /etc/init.d/nagios3 restart. You can now view your groups in your browser.

Final thoughts

We keep chugging along with Nagios, making it ever more useful to the already-too-busy administrator. In upcoming articles we will tackle other Nagios-specific tasks.

In this article I will show you how to quickly get Nagios up and running. In no time you will have Nagios up and running and monitoring your network.

Features of Nagios

Before we get to the installation, let’s take a look at the features of Nagios. Nagios can:

• Monitor network services (SMTP, POP3, HTTP, NNTP, PING, etc.)
• Monitor host resources (processor load, disk usage, etc.)
• Allow for simple plugin design
• Do parallelized service checks
• Define a network host hierarchy using
• Contact administrators when service or host problems occur
• Define event handlers to be run during service or host events for proactive problem resolution
• Automatd log file rotation
• Support the implementation of redundant monitoring hosts
• Offer an optional web interface for viewing current network status, notification and problem history, log file, etc

Sold yet? You should be, especially considering this tool is free and open source! Now, let’s get on with the installation.

Installation

Follow these simple steps to installing Nagios:

1. Fire up Synaptic.
2. Search for “nagios” (no quotes)
3. Mark nagios3 for installation (this will also pick up all of the dependencies)
4. Click Apply to install

During the installation you will be asked for an administrator password. This will be the password for the nagiosadmin user that will have access to the web interface. Once the installation is complete, you need to run a check to make sure everything is okay. The command for this check is:

sudo nagios3 -v /etc/nagios3/nagios.cfg

When this command runs you will see something like:

Nagios 3.0.2
Copyright (c) 1999-2008 Ethan Galstad (http://www.nagios.org)
Last Modified: 05-19-2008
License: GPL

Reading configuration data…

Running pre-flight check on configuration data…

Checking services…
Checked 7 services.
Checking hosts…
Checked 2 hosts.
Checking host groups…
Checked 5 host groups.
Checking service groups…
Checked 0 service groups.
Checking contacts…
Checked 1 contacts.
Checking contact groups…
Checked 1 contact groups.
Checking service escalations…
Checked 0 service escalations.
Checking service dependencies…
Checked 0 service dependencies.
Checking host escalations…
Checked 0 host escalations.
Checking host dependencies…
Checked 0 host dependencies.
Checking commands…
Checked 142 commands.
Checking time periods…
Checked 4 time periods.
Checking for circular paths between hosts…
Checking for circular host and service dependencies…
Checking global event handlers…
Checking obsessive compulsive processor commands…
Checking misc settings…

Total Warnings: 0
Total Errors:   0

With the results giving 0 errors and 0 warnings, you are ready to log in.

Logging in

Figure 1

Fire up your web browser and point it to http://IP_TO_SERVER/nagios3 at which point you will be asked for login credentials. Remember that password you gave during installation? That is the password you will use to login (with the user nagiosadmin).

When you log in you will be greeted with the Nagios welcome screen (see Figure 1), at which point you are ready to start monitoring.

Final thoughts

Wasn’t so bad was it? And you though Nagios was impossible to install. Fortunately it’s not. And even more fortunately is how powerful Nagios is. You will be blown away at how useful this tool is.

Big companies usually have IT staff that is monitoring the server infrastructure 24/7, something that most website and server owners cannot (and do not have the desire to) afford. Some webhosting companies provide 24/7 monitoring of their dedicated servers, virtual servers and web hosting packages but the effectiveness varies a lot and the account owner is usually not informed at once if something goes down (and back up again).

A third alternative are so called web monitoring services. These services are web based and offer a set of tools to monitor web servers and websites. Most of these services offer email, sms and even phone notifications as soon as the server goes down.

Pingdom is one of those services. The web monitoring service offers various http, network and email checks that can be configured easily. The number of services that are monitored depends on the user’s account level. Pingdom offers a free account that is good for monitoring one web service on one domain. The basic and business accounts raise those limits to 5 respectively 30 checks with the option to buy extra checks if needed.

Website Monitoring Setup

Pingdom does not require any installations or configurations on the web server or website that the user wants to monitor. All monitoring services are setup on the Pingdom website.

It starts by selecting one of the available check types.

This ranges from http checks over network checks that test the DNS, TCP port or UDP to email checks that can check Pop3, SMTP and IMAP connections. The check resolution, that is the interval in which the check is performed can be selected in this step as well. The interval ranges from every minute to every 60 minutes.

The next options differ depending on the choice in the first step. A http check for instance requires only the url of the website that should be checked. Entering the url completes this step which does provide optional settings which can help a user in performing specific tasks.

The Check For String On Page parameter for instance can easily be used to check if a database is up and running. To do that the webmaster needs to write (or copy and paste) a small script that displays certain text on a custom url if the website is up or down. This can for instance be UP if it is up and DOWN if it is down. The string check can be configured to report downtime if the DOWN string appeared on the page of the website or server.

Other optional settings in this step include configuring a username and password for websites that require authentication and changing the user-agent of the Pingdom service (which might make sense if third-party websites are monitored).

The final step of the process configured the notification options. Pingdom uses a contact database that can be filled with contacts that should be notified if a check fails. This can always be the same user or individual webmasters or system administrators depending on the website or even check that is performed.

Pingdom supports four types of notifications: SMS, Email, Twitter and iPhone. The number of available SMS depends on the account type. The free account comes with 20 SMS with the option to buy additional SMS if needed. An option that is missing is phone support which is offered by some other website monitoring services.

Reporting

Pingdom starts monitoring the configured services as soon as they have been created by the user. Reporting is one of the strengths of Pingdom.

The overview displays the most important data at a glance including the uptime, downtime and response time. This report can be filtered by data to provide an overview of a specific time frame.

Detailed reports are available for each website that is listed in the overview and from the sidebar menu.

Pingdom operates servers in many countries in the world that are used to monitor the configured websites, servers and services. Successful and failed attempts to connect will be written to an extensive log file that provides error analysis for some failed attempts. This includes information like the date and time of the operation, the datacenter used to perform the check and a traceroute which can be very helpful for the error analysis.

Pingdom Review Verdict

Pingdom offers a sophisticated web monitoring service with excellent reporting. The service is aimed at webmasters, system administrators and professionals mainly which is reflected in the interface which could use additional help overlays to guide the user through the creation. It would also be nice if they would add an option to receive phone notifications and if they would provide basic scripts to test specific services like MySQL databases.

But those are marginal and the overall experience and service lives up to its promises. The free basic account should be enough for many users who only run one website. Professionals on the other hand can use the basic and business account along with the optional services to monitor all their servers and websites.

Christmas Giveaway

We are giving away 10 Pingdom Basic Accounts that are paid for for one year. Please let us know if you currently use a website monitoring service and if so which to enter the draw for the accounts.

Raju is giving away two programs today: Corel Digital Studio 2010 and Corel Painter Essentials 4.

Beecher is giving away a copy of Team Fortress 2, best online fps game since UT99.

And what’s best is you don’t have to jump through a bunch of hoops to get munin up and running. In this tutorial you will see how to get your Munin server up and running and monitoring your system and a sample client configuration that will monitor a client node. As you might expect, I will continue to build upon the Ubuntu Server series and install Munin on a Ubuntu 9.04 installation. NOTE: This same installation will work on Ubuntu 9.10 as well.Server installation/configuration

Installing Munin on the Ubunter server is simple. Open up a terminal window (or log into your server console) and issue the command:

sudo apt-get install munin

The above command will also install munin-node which is the client-side software. This is fine, so let it happen. Upon installation Munin will install the configuration files in /etc/munin, the executable in /etc/init.d/, and the web files in /var/www/munin.

The first thing that will need to be done is to configure your server correctly. Open up the /etc/munin/munin.conf file and look for this section:

dbdir     /var/lib/munin
htmldir    /var/www/munin/
logdir     /var/log/munin
rundir     /var/run/munin

Out of the box, this will work just fine.  But if you have any other needs that would dictate any of these directives change, change them here.

The next section to look for is this:

# a simple host tree
[localhost.localdomain]
address 127.0.0.1
use_node_name yes

What the above section does is monitor the server Munin is installed on. This configuration only needs to change if you have specific requirements. Also, if you need to add a client (node), this is where you add it.

In order to instruct Munin to monitor a remote machine you need to add a new host tree. Say, for instance, you want to monitor a machine on the IP addres 192.168.1.150. To do this you would add:

[MACHINE NAME]
address 192.168.1.150
use_node_name yes

Where MACHINE NAME is a name to indicate the job (or user, or department, etc) of the machine.

Once you have these configurations and save the file. Now to move on to the /etc/munin/munin-node.conf file. There is only one configuration you would need to add in order to monitor nodes. Look for this line:

allow ^127\.0\.0\.1$

Beneath this line you will want to add (in order to enable our new node):

allow ^192\.168\.1\.1$

Save this file and restart the Munin server with the command:

/etc/init.d/munin restart

Installing for client

All you need to do for your client is to install the munin-node package. To do this issue the command:

sudo apt-get install munin-node

On the client machine. Now start munin-node with the command:

sudo /etc/init.d/munin-node start

Munin will begin to monitor this client now.

The graphs

When all is up and running, point your browser to http://ADDRESS_TO_SERVER/munin/

Figure 1

Where ADDRESS_TO_SERVER is the actual address of the server. Very shortly after you install Munin you may only see a listing of the nodes being watched (see Figure 1). This is okay, it will take some time before data is actually collected.

After a while you will notice data collected and graphs developing. If you click on the localhost.localdomain link you will see data beginning to collect (see Figure 2).

Figure 2

Final thoughts

Munin is a very powerful tool that allows you to gather crucial data about your systems and networks. Now that you have Munin installed and running you can begin to extend the server by adding more and more clients as well as plugins. You will quickly find Munin to be a very valuable tool for data analysis on your various systems and networks.

Networx offers several network and bandwidth related tools in its interface. It will place an icon in the Windows system tray after download that will open a bandwidth monitor on left-click and the context menu with all the available modules on a right-click.

The bandwidth monitor will display useful information about the bandwidth consumption of the computer system including daily, weekly and monthly reports, an overview of today’s bandwidth consumption, custom bandwidth reports, dial up sessions and hourly rates. Data can be exported and backed up among other things. This module gives the system administrator a quick overview of the bandwidth consumption of the computer system.

Networx offers additional modules that aid in the network monitoring process. This includes a speedmeter which can measure the network’s (or network devices) throughput. The tool is basically a speed test that will monitor the current network traffic and display the current, average and maximum transfer rates.

It is furthermore possible to setup a bandwidth quota and trigger alerts if 80% of that quota has been used. It is also possible to configure the quota to only cover upload or download bandwidth and set it to be a daily, weekly or monthly quota.

Ping, traceroute and netstat commands are available from the context menu of the network monitoring software as well. The options are quite extensive and allow the user to select an individual networking adapter to be monitored, configure notifications or define on and off peak hours.

Networx might not be the most sophisticated network monitoring software but it proves to be a nice solution for single computer systems.

We have dealt with several services in the past including the network monitoring software Open Monitor or the online service Livewatch.

The database monitoring software dv2rss is different from these solutions. The main difference is that it can – as the title implies – monitor databases but also because it can only be run from the command line or a script. That’s not as bad as it sounds and it could be welcome in certain situations where no graphical user interface is needed or wanted.

Db2rss supports MySQL, Interbase and Blackfish SQL databases at the moment and can monitor them in a computer network or on the Internet. It comes with several command line parameters that define important information such as the database’s host name, the username and password. There are quite a few additional parameter that include running an SQL command on the database, comparing the results to a local copy and defining templates and title of the resulting RSS feed. The RSS feed is another aspect of this database monitoring software that is usually not found in other monitoring software programs.

It is then possible to subscribe to the RSS feed to receive the database monitoring information after the script’s execution. The software developer suggests to use the Windows task scheduler to run the database monitoring software regularly.

The ICSI Netalyzr is a new beta online network troubleshooting analyzer that can analyze various aspects of a computer’s network connection. It is made up of a Java applet that has to be executed on the user’s system. The benefits of a Java Applet are that it is system independent and that it can access and analyze the computer’s hardware and other aspects of the computer system.

The analysis will take a while and an in depth network troubleshooting report will be generated and presented to the user in the end.

The network troubleshooting report is divided into two sections. The first reports on noteworthy events and is further divided into major abnormalities and minor aberrations. The second section displays the detailed network troubleshooting report that is colored for easier access. Entries with red backgrounds describe network problems while green backgrounds display unproblematic network elements.

Each title in the report is clickable leading to a short explanation of how the tests are conducted. Related articles can be found about Network Bandwidth and Network Monitoring Software.

Not everyone wants to pay to monitor websites though. The free portable software program SiteMonitor provides a local solution for the Windows operating system. It requires the Microsoft .net Framework 2.0 and can be configured to monitor selected websites and notify the user if they become unreachable. It is a good alternative as long as it is run on a computer system that is online 24/7.

New urls can be added easily to SiteMonitor. All that it takes is to add a descriptive name, an url and HTML to match which is simply content that should appear on the website. The website monitoring software will check every 30 minutes by default; To much for important websites. The interval can be changed in the options. The options are also the place where the notification preferences can be edited. The website monitor provides two different types of reactions to website connection problems:

• Run a script or executable, e.g. a script that will restart a server or service
• Send email to notify a user about the connection problem

The amount of failures before either one of the reactions will be initiated can be configured in the same menu as well.

Below is the small php script that we use to check if the database is up and running on Ghacks:

<?php
$dbhost = 'localhost';
$dbuser = 'username';
$dbpass = 'password';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error');

$dbname = 'databasename';
mysql_select_db($dbname);

if ($conn) {echo "ok";}
else {echo "error";}

?>

replace username with the database username, password with the password of the username and databasename with the name of the database. Save it as database.php, upload it to your website and load the new file. It should display ok if the database is up and error if it is down. The url that points to the script can then be added to the website monitoring software to check if it returns ok. If it does the website is up, if it does not it is down.

Alternatives are the Website Monitor and Downloader Wysigot, Montastic or the Server Monitor Observu.

The wavemon tool is a very handy tool to have in your arsenal that will help you gather information you might not otherwise have. With wavemon you can see Signal levels, Noise levels, Signal to noise ratios, frequencies, TX power, sensitivity (if available), bitrate, and so much more.

One of the only issues that might turn you off of wavemon is that it is an NCurses tool. This means the tool is run in a terminal window (I have found it runs best under Eterm) and uses ASCII to create the information it offers. Don’t let this cause you not to want to use wavemon because it is a very useful tool.

Getting and Installing

Wavemon is downloaded and installed from source. Download the tarball from the Wavemon site and save it to your hard drive. The installation steps are simple:

• decompress wavemon with the command bunzip2 xvzf wavemon-current.tar.bz2
• untar the archive with the command tar xvf wavemon-current.tar
• cd into the newly created directory with cd wavemon-current
• generate the make file will ./configure
• install wavemon with make ; make install
• start wavemon with the command wavemon

Wavemon Info Window

As you can see, in the image on the left, the Wavemon info window offers a lot of information.

At the bottom of the screen you will notice there are 10 possible options (of which some have no entries). Each of these options are different screens you can view.

The list of windows is:

• F1: Info. This is the main window that opens upon start up. This is where you get most of the information from wavemon.
• F2: Level Histogram. This displays a real-time bar-graph of Signal level, Noise level, and Signal-to-Noise Ratio.
• F3: Access point list. This feature has not been implemented yet.
• F7: Preferences. Configure Wavemon.
• F8: Help. Like a lot of Linux applications, wavemon shows the developer has a sense of humor. When you hit F8 for help it displays the message “don’t panic”. That’s it. There is more help by reading the man page (issue the command man wavemon).
• F9: About. Get all the information you need about the current wavemon release.
• F10: Quit.

You can also start wavemon with a few handy options. Those options are:

• -i This will override auto detection and use a specified network interface.
• -l Use linear level scales instead of logarithmic scales.
• -r Generate random levels for testing.

Final thoughts

If you need more information than your standard networking tools offer, and do not want to dump any extra cash into a third party offering, wavemon is just the tool for those looking to know everything there is to know about their networks. It’s easy to use, offers a ton of information, is open source, and has a tiny foot print.

The information that are displayed after the network scan are – among others – computer names, IP addresses, operating systems, uptime, MAC address, domain name and user name. The collected data can be sorted in numerous ways. The free version of NEWT has a few limitations like only being able to scan and monitor 25 computers, no SNMP device detection or multithreaded IP Range discovery.

Next to the computer analysis it is possible to send a few commands to remote computers in the network. It is possible to send messages, ping computers or to turn them on or off remotely.

The network monitoring software is compatible with most Microsoft operating systems including Windows XP, Windows Vista and even the soon to be released Windows 7.

Update: The network monitoring software Newt has been discontinued by its developers. The project page simply states that NEWT Freeware is no longer available, and that its developers are dedicating all resources to the professional version of the applications.

If you are looking for a network monitoring software you may want to check out the following alternative which we have reviewed in the past:

York – A network monitor for the Windows operating system that automatically filters traffic into groups such as passwords, files or pictures. The program supports logging into files and saving of the raw network traffic into a file for further analysis.

The program is compatible with all 32-bit and 64-bit editions of the Microsoft Windows operating system. Just follow the link above to find out more about it.

Etherape is a graphical network monitoring tool based on etherman that features link-layer, tcp, and ip modes. Etherape is a real time monitor who’s graphic representation instantly changes as network traffic goes in and out. You can use Etherape live or have it read from a dump file. Etherape supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices so you shouldn’t have any problem getting it to work on your network.

Installing

Installing Etherape is simple. Open up your Add/Remove Software utility, do a search for “etherape” and select the entry when it appears. Apply the changes to install the application. If you prefer to go the command line route you can isse the command “sudo apt-get install etherape”. Once you have the application installed you can start Etherape by issuing the command etherape from a command line. You can also start Etherape from the Applications menu by looking in the Tools | System Tools submenus.

The Main Window

When you first open up Etherape (you will need the root password) you will see a blank window with some buttons and menus. At this point you are not capturing any packets because you haven’t instructed Etherape what interfaces to use.

Configure Etherape Interfaces

In order to configure the interface click on the Capture menu and then click in the Interfaces sub-menu. Select the interface your machine uses to continue. Note that, as of this writing, Etherape does not support the Wifi0 interface. If you are using wireless you will most likely be able to use ath0.

Once you have configured the interface select the Mode type from the same menu you found the Interfaces entry.

Etherape will immediately begin capturing packets. You will see the large black window quickly fill with traffic. Depending upon your network your window can fill up very quickly. You will also notice that Etherape contains a color-coded legend.

Etherape Capturing Packets

By default CUPS and Domain are blue, WWW, TCP, ICMP are red, IMAP2 is purple, and POP3 is yellow. These colors can be changed in the Preferences window to whatever you like.

As you can see (in the image to the right) there is a lot of external traffic. But what if you only want to monitor internal traffic? Simple In the Preferences window click on the Diagram tab. You will see a small text area labeled “Capture Filter”. In this text area you will enter something similar to: ip and src net 192.168 and dst net 192.168 (where 192.168 is the first two sections of your internal network addressing.)

Once you enter that information, click Save, and the preferences window will go away. Etherape will now start capturing only your internal traffic.

Reading From Files

Etherape can read files from the tcpdump application. But you must run tcpdump with the -n and -w flags. The tcpdump command would be run like so: tcpdump -n -w dump_file. Once you are satisfied you have enough information you can stop the dump with ctrl-c. Once you have your dump file you can open it by going to File and then selected Open. The captured packets will display in real time as they were captured during tcpdump’s run.

Final Thoughts

Etherape is the perfect tool for monitoring network traffic. Not only is it simple to use, it gives you instant output as traffic comes in and out of your network.

The network monitoring software can be used to monitor incoming and outgoing traffic of selected network adapters and connections. Traffic is shown in graphs and logged in files for further processing. Reports are extensive and provide access to daily, weekly, monthly and custom reports. Even better, reports can be exported which can be useful for book keeping among other things.

A realtime network traffic graph visualizes the incoming and outgoing traffic. Notifications can be used to perform actions under certain conditions. They can be configured to run so called actions when network traffic drops or rises above a certain level. Possible actions include running a software, displaying visual and sound alerts or to drop the connection.

Networx includes network information and testing tools like netstat that display all applications currently using the network connection. The application uses roughly 10 Megabytes of computer memory in minimized state.

Update: The program sits quietly in the system tray of the operating system for most of the time it is running. A right-click brings up the program menu where you can display or hide the traffic graph on the desktop and access other tools and settings.

The application is offered as a setup and portable version, ideal for users who carry an USB or troubleshooting DVD with them around when they to tech support. The latest program version is compatible with all recent versions of the Microsoft Windows operating system, including 32-bit and 64-bit editions of Windows Vista and Windows 7, as well as Windows server variants.

NetWorx 5 has been released in 2009, check out our review of the new version here.

One of the main features of the network monitoring software is the ability to automatically scan a network based on a network adapter, device or selected IP range. The software will scan the selected range and display all connected computers and devices after the fast scan.

A click on a network device opens the Proof Scan window that provides access to information such as Ping, Traceroute, Netbios, running network services and SNMP System plus additional links to advanced traceroutes and a graphical ping view.

Other features of the network monitoring software include a hierarchical view of the network, a search, graphs and network trapping. Trapping will alert the user of network status changes, for example when a network device goes online of offline.

One network management feature is the generation of network status reports which are saved in html format. They display a detailed view of IP addresses including graphs.

Update: The Look@Lan project has been discontinued by its developers. The program is no longer updated and likely not compatible anymore with more recent versions of the Windows operating system.

The developers have released a new program called Fing, which in its current development stage, is a command line utility for network and service discovery. Unlike Look@Lan which has only been available for windows, Fing is also available for other platforms including various Linux distributions, Mac OS X and the Android operating system.

Fing’s developers have promised that they will release a version with a graphical user interface in the future. The latest version of Fing can be downloaded from the project homepage. I suggest you check out the documentation posted there to get started.