Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to monitor all and any internet traffic from my home PC to see what programs installed on my home machine are accessing the internet.

I thought I could use Fiddler for this but I noticed Firefox traffic doesn't show up by default, you need to do some setup.

What options do I have to monitor all traffic?

share|improve this question
1  
This sort of question has been done to death. Why answer when you know it's a duplicate? –  alex Jan 18 '10 at 7:10
1  
Maybe migrate this question to softwarerecs.stackexchange.com ? –  Jet May 26 at 17:28
    
@Jet The migration policy is not to migrate anything over 6 months old. It's here FOREVER. –  Excellll May 27 at 15:03
add comment

15 Answers

up vote 17 down vote accepted

I would recommend using TCPView which is part of the sysinternals suite. TCPView will show you all of the connections being opened by the TCP/IP stack and it will also show you the remote address of the system it is talking to across the net.

share|improve this answer
add comment

Wireshark

The added advantage is that it is cross platform. Linux, Windows and Mac.

share|improve this answer
    
For specific programs that could be cumbersome with hundreds of packets flying by at once, but it is good for analysis overall. –  John T Aug 14 '09 at 0:37
3  
I have to agree with John on this one. A packet sniffer is going to give you far too much information for it to be useful in spotting the problematic connections. –  Axxmasterr Aug 14 '09 at 0:51
2  
They have a very robust filter building system. And he did say "all traffic" -- that includes TCP, UDP, ICMP. Other tools are more limited. –  JP Alioto Aug 14 '09 at 0:51
add comment

How about Sysinternals TCPView?

enter image description here

share|improve this answer
add comment

If all you want with your monitoring is to see which programs access the Internet then a normal software firewall should do the trick as well.

If you want more fine grained information the other suggestions are better suited.

share|improve this answer
add comment

If you're looking at a router, try to find SNMP data for it, then you can graph it with munin, mrtg, or a whole bunch of other SNMP handling devices.

If you're looking at a linux box, install something like iptraf (command line, ncurses traffic monitor), or munin (graphing util).

If you're looking at a windows box, perhaps use the Performance console in Administrative Tools.

If you had a cisco router capable of supporting NetFlow data, you could use this and a NetFlow listener to look at the traffic data.

share|improve this answer
add comment

If by look at you mean to measure the bandwidth then maybe a program like BitMeter II or BitMeter OS is what you are looking for.

If you actually want to look at the traffic, the a program like WireShark might be what you are looking for.

share|improve this answer
add comment

NetWorx is a simple and free, yet powerful tool that helps you objectively evaluate your bandwidth situation. You can use it to collect bandwidth usage data and measure the speed of your Internet or any other network connection. NetWorx can help you identify possible sources of network problems, ensure that you do not exceed the bandwidth limits specified by your ISP, or track down suspicious network activity characteristic of Trojan horses and hacker attacks.

alt text

The program allows you to monitor all your network connections or a specific network connection (such as Ethernet or PPP) only. The software also features a system of highly customizable visual and sound alerts. You can set it up to alert you when the network connection is down or when some suspicious activity, such as unusually heavy data flow, occurs. It can also automatically disconnect all dialup connections and shut down the system.

enter image description here

The incoming and outgoing traffic is represented on a line chart and logged to a file, so that you can always view statistics about your daily, weekly and monthly bandwidth usage and dialup duration. The reports can be exported to a variety of formats, such as HTML, MS Word and Excel, for further analysis.

share|improve this answer
add comment

I see one of your tags is router, so I assume you want to monitor all incoming and outgoing traffic in your network from the router level. If you want to get adventurous, you can check out third party firmware. If your router can support third party firmware such as Tomato, it will keep detailed bandwidth usage logs that you can view:

enter image description here

enter image description here

I'm sure the others (DD-WRT, OpenWRT, etc) also have methods of viewing bandwidth usage.

share|improve this answer
add comment

Nirsoft Currports

I prefer this one to Sysinternals TCPView because it have filters and logs features

enter image description here

Comodo Firewall

In "Custom Policy Mode" you will be prompted for authorization each time a program create a connection...

enter image description here

share|improve this answer
add comment

Microsoft's freeware Network Monitor is also quite useful. It's not quite as hardcore as Wireshark (which is nevertheless awesome) so it's perhaps a bit easier to use. I particularly like the way it organizes results and associates traffic with specific applications and services.

share|improve this answer
add comment

Use NetSpeedMonitor.

NetSpeedMonitor is a lightweight Network Monitoring Toolbar for your Windows Taskbar designed to be used on computers that run Windows XP, Windows Server 2003, Windows Vista or Windows 7.

Daily and Monthly Traffic Reports

The amount of data transferred each day, month, and year can be saved in a SQLite Database. SQLite is the most widely deployed Open Source SQL database engine in the world and requires not additional setup.

enter image description here

share|improve this answer
add comment

Using Linux it could be an easy way to check what is going on with your Windows traffic. And there is even portable alternative to Linux like vbox.me. The idea is that you could boot your actual system (i.e. your Windows XP installed on your C:) in virtual machine using VirtualBox. You should create new virtual machine and set your real partition (C:) to be used as HDD in this virtual machine. And using VirtualBox option like VBoxManage modifyvm [WindowsXp] --nictrace[adapternumber] on --nictracefile[adapter-number] filename.pcap you will create full traffic dump of your VM that could be loaded into Wireshark and analyzed.

The only question is to have any other OS to boot into to use VirtualBox, and there are many ways.

share|improve this answer
add comment

CommView is one of the best solutions (the one which can compete with WireShark).

This is what you can do with CommView

  • View detailed IP connections statistics: IP addresses, ports, sessions, etc.
  • Reconstruct TCP sessions.
  • Map packets to the application that is sending or receiving them.
  • View protocols distribution, bandwidth utilization, and network nodes charts and tables.
  • Generate traffic reports in real time.
  • Browse captured and decoded packets in real time.
  • Search for strings or hex data in captured packet contents.
  • Import and export packets in Sniffer®, EtherPeek™, AiroPeek™, Observer®, NetMon, and Tcpdump formats, export packets in hex and text formats.
  • Configure alarms that can notify you about important events, such as suspicious packets, high bandwidth utilization, unknown addresses, etc.
  • Create your own plug-ins for decoding any protocol.
  • Exchange data with your application over TCP/IP.
  • Export any IP address to SmartWhois for quick, easy IP lookup.
  • Capture loopback traffic.
  • And much more!

You can get it here: http://www.tamos.com/products/commview/

share|improve this answer
add comment

On Windows 95/NT/98/Me/2000/XP you can use Sygate Personal Firewall:

enter image description here

On Linux/Mac/Windows, you can use WhatPulse Premium: enter image description here

share|improve this answer
add comment

Only a network device can see all users. That means your router. However, most home routers only show the most basic information, who is connected, and sometimes what IP they are connected to.

Thus, the basic answer is you cannot do what you want. Only exception is to build a free Linux based firewall, one that can monitor all users and their traffic, and replace your existing router with it. Only other option is to buy some commercial equipment like micro keylogger... Either way, it is hard to do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.