• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Network traffic overload

S

Stoly

Supreme [H]ardness
Joined
Jul 26, 2005
Messages
6,706
I suspect a pc is infected with a virus that overloads the network

How do I detect network traffic so I can pinpoint which PC has the problem. There are about 20 pcs/laptops on the network.
 
You could install Wireshark which is a packet sniffer. Let it sniff for a while on another PC and then you can run a report to see what IP had the most traffic.

May also need to install it at the gateway. Depends what part is being overloaded.
 
If you have a managed router or the like you can run a netflow analysis like ip flow top-talkers that can sort traffic by IP and traffic volume.
 
Red Squirrel said:
You could install Wireshark which is a packet sniffer. Let it sniff for a while on another PC and then you can run a report to see what IP had the most traffic.

May also need to install it at the gateway. Depends what part is being overloaded.
Click to expand...

Also to remember that Wireshark will bog the network down while its sniffing. So make sure to notify the users that they will see their network connections go down for a period of time if/when you go this route.
 
GreenMachine said:
Also to remember that Wireshark will bog the network down while its sniffing. So make sure to notify the users that they will see their network connections go down for a period of time if/when you go this route.
Click to expand...

That is only if it is installed inline. If you sniff a monitor port (as is done in the real world), performance is completely unaffected as no traffic is flowing through the sniffer - you are only monitoring a port that is duplicating the traffic of the other port.

However, this is what netflow was designed to do so that's the route I'd go.
 
A port span or port monitor is the way to go with Wireshark / tshark. Just be careful about over subscribing the monitoring interface.
 
You must log in or register to reply here.
Back
Top