Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am looking to monitor my network usage (on a packet level). Everything. Logging is a strict requirement. I need to be able to log HTTP and DNS queries, for storage, over time.

Yes, I have the network setup in place to capture this. I have been using Colasoft Capsa, but am looking for different solutions due to stability issues.

Yes, I have tried Wireshark. I can't seem to get it to discard packets and focus on logging what I want in a sane manner. Also, some form of endpoint graphing or reporting (top talkers, popular endpoints, and usage breakdown and filtering by traffic type) is a requirement. If I am blatantly missing something let me know. But I don't think Wireshark will work for me.

Obviously with Capsa, I am in a Windows environment but I am fine with moving to Linux if need be. I have spent quite a bit of time looking but cannot find an alternative.

I have SNMP graphing and services checking already covered, for what it is worth.

I am not against a paid solution, but would prefer anything open source. Any of your thoughts and suggestions would be highly appreciated!

share|improve this question
    
You should use a dedicated piece of hardware if you want to do this properly. However, my company uses a tool called PacketTrap MSP which works pretty well, but is fairly expensive. –  user3463 Jul 14 '12 at 19:46
add comment

3 Answers

All the implementations I saw where there was a requirement of logging all packets or certain packets were done with equipment by Check-point. You will still need some other tools for graphing I think.

Another solution is to use a Linux intermediary to log all packets and feed them to Splunk. Splunk is a very good tool to build graphs and automatically generate reports.

share|improve this answer
add comment

Have a look at ntop (linux package), it logs just about everything from my own experience and can produce reports as needed.

share|improve this answer
add comment

BTW this can be done very easily with Wireshark by using the following filter

tcp.srcport == 443 or tcp.srcport == 80 or udp.srcport ==53

You can remove the tcp.srcport == 443 if you are not interested in HTTPS packets.

Wireshark can also produce endpoint reports (Statistics > Endpoints), response time. conversation list, protocol hierarchy, etc..

I would give Wireshark another chance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.