Etherape is a graphical network monitoring tool based on etherman that features link-layer, tcp, and ip modes. Etherape is a real time monitor who’s graphic representation instantly changes as network traffic goes in and out. You can use Etherape live or have it read from a dump file. Etherape supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices so you shouldn’t have any problem getting it to work on your network.

Installing

Installing Etherape is simple. Open up your Add/Remove Software utility, do a search for “etherape” and select the entry when it appears. Apply the changes to install the application. If you prefer to go the command line route you can isse the command “sudo apt-get install etherape”. Once you have the application installed you can start Etherape by issuing the command etherape from a command line. You can also start Etherape from the Applications menu by looking in the Tools | System Tools submenus.

The Main Window

When you first open up Etherape (you will need the root password) you will see a blank window with some buttons and menus. At this point you are not capturing any packets because you haven’t instructed Etherape what interfaces to use.

Configure Etherape Interfaces

In order to configure the interface click on the Capture menu and then click in the Interfaces sub-menu. Select the interface your machine uses to continue. Note that, as of this writing, Etherape does not support the Wifi0 interface. If you are using wireless you will most likely be able to use ath0.

Once you have configured the interface select the Mode type from the same menu you found the Interfaces entry.

Etherape will immediately begin capturing packets. You will see the large black window quickly fill with traffic. Depending upon your network your window can fill up very quickly. You will also notice that Etherape contains a color-coded legend.

Etherape Capturing Packets

By default CUPS and Domain are blue, WWW, TCP, ICMP are red, IMAP2 is purple, and POP3 is yellow. These colors can be changed in the Preferences window to whatever you like.

As you can see (in the image to the right) there is a lot of external traffic. But what if you only want to monitor internal traffic? Simple In the Preferences window click on the Diagram tab. You will see a small text area labeled “Capture Filter”. In this text area you will enter something similar to: ip and src net 192.168 and dst net 192.168 (where 192.168 is the first two sections of your internal network addressing.)

Once you enter that information, click Save, and the preferences window will go away. Etherape will now start capturing only your internal traffic.

Reading From Files

Etherape can read files from the tcpdump application. But you must run tcpdump with the -n and -w flags. The tcpdump command would be run like so: tcpdump -n -w dump_file. Once you are satisfied you have enough information you can stop the dump with ctrl-c. Once you have your dump file you can open it by going to File and then selected Open. The captured packets will display in real time as they were captured during tcpdump’s run.

Final Thoughts

Etherape is the perfect tool for monitoring network traffic. Not only is it simple to use, it gives you instant output as traffic comes in and out of your network.

Related posts

• Gather Wireless Information with Wavemon (8)
• Yoggie PICO Personal Mobile Security Computer (3)
• With Ubuntu 9.10 Arrives Wubi 9.10 (2)
• Widgets for Linux: SuperKaramba (6)
• Widgets for Linux: gDesklets (3)

NetCPS – the easier way

This little tool called NetCPS (a single executable file) is rather simplistic, no fancy features as the author (credits to Jarle Aase) says. It pumps 100MB of generated data (without accessing the HDD which could mess with the final result) and then displays the result in form of average speed stated in both KB/s and MB/s. Sourcecode is available for download as well in case you’d like to do some further tinkering with it. Freely usable unless you intend to use it on behalf of military or government.

Example of use:

Server-side end-point: netcps -server
Client-side end-point2: netcps *IP address/hostname of the host*

Additional switches to change the default port (4455) and default amount of transfered data (100MB) are supported. Use the -help switch for further instructions.

Iperf – the powerful way

This tool on the contrary is rather advanced while still maintaining its portability and small size. It can measure performance with many different settings but those are optional and not neccessary for the essential purpose of finding out what the network’s throughput is. You can affect a lot of settings by changing them with various switches. Take notice of the example screenshot for instance, where the port used is changed to 1234, amount of sent data set to 200 MB, interval of reports set to 2 seconds for better accuracy and report format set to MBytes. Iperf can be run as a solid Windows service as well. Here’s a download link to the compiled Windows version of Iperf (a single executable).

Example of use:

Server-side end-point: iperf -s -p 1234
Client-side end-point2: iperf -c *IP address/hostname of the host*

Many additional switches and settings are available for advanced use of this nifty utility. The usual -help switch brings up further instructions again.

Related posts

• Who is connected to your pc right now ? (6)
• ZoneScreen Finally Gets 64-bit Update (7)
• Who shares your shared hosting? (5)
• Webmasters: Search For Links Posted On Twitter (3)
• Use Multiple Screens over Network (11)

But what if you want to do it automatically ? Say you happen to transcode videos every now and then and want that process to be below normal to continue working with your computer during the process. Or you would like to assign a higher process priority to a game that you like to play and that needs all the cpu cycles that it can get.

I can tell from personal experience that there are many applications where an automatic adjustment of the process priority would come in handy.

One tool that does the job is Prio, the Priority Saver. It adds this functionality to the Windows Task Manager. The most important feature that it introduces is the ability to save priorities for processes. To do that you simply select another process priority and check the Save Priority entry in the same menu as well.

Every time the process is started it will run with the selected priority from now on. The different colors are also added by Priority Saver. Green colors are assigned to processes with a digital signature while red colored ones do not have one. Hovering the mouse over a process will display a tooltip with additional information about it.

Priority Saver adds two new tabs to the Windows Task Manager as well which are called Services and TCP / IP.

The services tab displays all services currently installed on the system. This menu makes it possible to start and stop services and change their startup mode which makes the services.msc application redundant.

The TCP/IP tab displays all incoming and outgoing network connections of the computer. Tooltips aid in determining the process that is responsible for the connection.

Process Priority is free for personal use and runs fine in Windows XP. There is no information available about other supported operating systems.

Related posts

• Windows Explorer File Extension Column (8)
• Why is nvsvc32.exe running on my system ? (1)
• What is running on my system ? (0)
• Task Manager Replacement (4)
• Remove Unnecessary Entries From The New File Menu (3)

It is not absolutely clear to me why Microsoft did set the limitation, some possible reasons could be to prevent worms and other malicious scripts from spreading to fast or to limit filesharing. Users will most likely notice that something is wrong when running P2P clients, slow downloads and timeouts are indicators that the limit is set.

Thankfully a solution exists that can patch the file tcpip.sys and remove the security limit. To do that you need to download the file Vista TCP Patch, open an elevated command prompt with administrator rights and enter the following command. VistaTcpPatch /n X with X being the maximum amount of half-open connections allowed on that system.

The computer needs to be restarted afterwards. Some users reported that they needed to execute Vista TCP Patch from the \Windows\System32\ folder to make it work.

Windows XP users can download and run the software EventID 4226 Patcher Version 2.23d instead which basically does the same thing but sets the limit to 50 half-open connections.

Vista TCP Patch (for Windows Vista)
EventID 4226 Patcher Version 2.23d (for Windows XP)

Related posts

• The Big Guys get it Wrong Once Again, Prosecute Innocent People (7)
• Private Encrypted File Sharing (6)
• P2P: The Owner Free File System (5)
• Joe Biden: Piracy’s New Enemy (18)
• FrostWire, free and fast Gnutella (5)