Trying to catch Bittorrent users with Wireshark...

[jmroberts70]

Please understand, I'm no expert when it comes to managed switches but I think I'm grasping the concepts. I'm trying to locate Bittorrent traffic on a fairly large network. We have around 6 Dell Powerconnect 5424 switches and one Cisco Catalyst 2950 switch on the network. I attached a laptop running Wireshark on an available port and start capturing traffic. Problem is, I believe I need to turn on Port Monitoring to be able to capture ALL the traffic. Here are my problems:

1. I've never had to do any messing around with either Dell or Cisco managed switches before (although I'm not afraid of CLI platforms since I used to work that way all the time).

2. Doesn't port monitoring just link one port to another so I can just see the traffic from the source port? Meaning, I could potentially make the "source" port for monitoring the uplink port on the switch and the "destination" port for the receiving the packet information my laptop running Wireshark. Won't this just capture the traffic of that switch alone and not the rest of the network? Maybe I need to run Wireshark from the main router?

If there is anyone out there that lives in Southern California, I'd love to talk with you about this. I am totally in the dark here as I have no one I can call or question about this sort of thing. I'm sure I can figure it out by plowing through the documentation but I'm afraid of damaging the network in the process from going directly to the operation I need to perform and miss something in between!!

Hell, I may still just go for it but I'd really like to talk to someone that is much more familiar with this equipment...

 

[Tee]

http://wiki.wireshark.org/BitTorrent

That.

Also I would use something like squid or snort to help get rid of BitTorent. Most webfilter products will block torrent traffic as well.

It doesn't matter where you hook up the machine with Wireshark as long as it's on the same network.

 

[jmroberts70]

I've actually been able to successfully demonstrate catching Bittorrent traffic in my shop but that was a much smaller network (with just one unmanaged switch). I'm worried that I may not be able to detect the traffic that occurs through the other switches on the LAN unless I'm tied into the main router.

 

[mi7chy]

Ideal is to span the switchport that the internet firewall inside interface or router LAN port is connect to.

 

[ambientZ]

as mi7chy says, you'd mirror a port carrying all the traffic to the external internet, or out of your area off to the external connection, all the traffic will go through the one port.

 

[MadJuggla9]

If your behind a router it doesn't matter how many switches you have (assuming a bridged network). You can watch backhaul private IPs or your lan's public ips since they are local to YOUR network.