Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

WireShark is good at showing me every packet that is sent or received over an interface.

But I'm really trying to find a way to monitor traffic on a machine. In other words, rather than seeing:

00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532
00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532
00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532
00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532
00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532

I would want to see:

00-03-FF-54-D8-DF => 00-03-FF-54-D8-DE  TCP  10.0.0.11:32532 => 10.0.0.12:80  5
00-03-FF-54-D8-DE => 00-03-FF-54-D8-DF  TCP  10.0.0.12:80 => 10.0.0.11:32532  5

And if possible, even more advanced logic:

Listen MAC        Listen Addr     Source MAC        Source Addr     Proto  In  Out
================= ============    ================= =============== =====  ==  ==
00-03-FF-54-D8-DE 10.0.0.12:80 <= 00-03-FF-54-D8-DF 10.0.0.11:32532 TCP    5   5
00-03-FF-54-D8-DE 10.0.0.12:80 <= 00-03-FF-54-D8-D3 10.0.0.42:53213 TCP    5   5

In other words, aggregation and grouping.

How can I use WireShark to monitor traffic, rather than capture packets?

share|improve this question
1  
Unless you've got other reasons for it you might have better luck if you remove the wireshark part of the question. I assume you really just want a traffic monitor that works and it may or may not have anything to do with wireshark. There are traffic monitors like you want, some with graphical interfaces but as it stands people might not mention them. –  hotei Sep 24 '10 at 14:55
    
I see that you are watching HTTP traffic. Fiddler is a great program for watching HTTP traffic. –  Nick Berardi Jan 11 '12 at 14:28
add comment

3 Answers

up vote 5 down vote accepted

Wireshark is a terrific program, but there are other freeware and open source alternatives that may be somewhat easier to use. My current favourites are Microsoft Network Monitor and SmartSniff.

Using SmartSniff in summary mode should provide the information you want. Options > Advanced Options > Summary mode: enable; Options > Advanced Options > Retrieve process information: enable; Options > Resolve IP Addresses: enable.

share|improve this answer
1  
+1. Wow, SmartSniff is very impressive. It can detect, and use, different methods of capturing traffic: raw sockets, WinPCap, or Microsoft's Network Monitor driver. WireShark could learn something about usability. –  Ian Boyd Sep 25 '10 at 23:03
add comment

What about the

Statistics -> Conversations

window?

You can have name resolution of address and event filter the conversations.

share|improve this answer
add comment

Wireshark is famous for its powerful capability of capturing traffic and protocol analyzing. But if you need to have graphic views of the traffic or monitor network performance, you need to buy Pilot which is a powerful analyzing tool.

However as the above answer said, there is some freeware you can use instead of Wireshark. I recently found a very good one at PC World: Capsa.

Very good one, worth trying.

share|improve this answer
    
+1 for Capsa. Powerful, comprehensive, extremely well designed software. I've added it to my toolkit. Thanks! –  boot13 Sep 26 '10 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.