Content

• To step
• Tips
• Warnings

Monitoring network traffic is not just for large companies; this is also useful on smaller networks. Monitoring your small business or home network has a lot of benefits and can reveal surprising things. It is best to have a basic understanding of networks and protocols before checking network traffic.

To step

1. Download the Wireshark (formerly Ethereal) program from http://www.wireshark.org/. This is the most popular program and used by network professionals around the world. You can even be certified as an Official Wireshark Certified Network Analyst.
2. Install Wireshark and WinPcap. WinPcap is used to intercept network packets.
3. Open Wireshark. Click the "Capture" menu and then "Interfaces". A small window will appear with all your network interfaces. If there is network traffic, you will see packets passing by.
4. Click the "Start" button to start monitoring network traffic.
5. Stop monitoring network traffic. Go to the "Capture" menu again and then click "Stop". By stopping the network traffic you can analyze it better. However, you can tell the program to keep track of the network traffic while you go through the packets.
6. Examine the information of each package. Each line represents a package, and there are six columns that provide information about it.
   • The number column shows the order of the packet when it starts recording the network traffic. This is to provide you with a reference number so that you can easily identify each package.
   • The time is the time in seconds (to six decimal places) that the packet was received after you started tracking network traffic.
   • The resource contains the Internet Protocol (IP) address of the origin of the packet.
   • The target IP keeps track of where a particular packet goes.
   • The protocol that the package uses. The most common are TCP, UDP and HTTP.
   • Info tells you what is happening with the packet - whether it is a continuation of network traffic, or a confirmation that a packet has been received.
7. Analyze the list of packages. You can check many different things with WireShark.
   • Check for unwanted packets being sent or received from your computer. This could be someone you don't want on your network or even a program that shouldn't be using the network traffic.
   • Check how often a program uses your network. For example, how often does Windows Update check for updates?
   • Find out which program is eating up all your network traffic and slowing down the network.

Tips

• To be certified for Wireshark, check out the book: Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide.

Warnings

• Monitoring network traffic can be confusing; it is better to have basic knowledge of networks and protocols before monitoring network traffic. You won't just become a professional network administrator for a while, and it will take some time to learn.