Network Monitoring Tools

Network monitoring tools are mostly used by network administrators to look for network configuration errors or monitor network workload. These tools are also an indispensable resource for programmers who develop network applications. To give you an example, let's say you have written a client/server application. You start the application and nothing happens—the client does not even connect to the server. At this point, you cannot be sure whether the problem lies with the client or the server. By capturing frames, however, you can establish that the client sent a data frame, but the server did not react and the fault is therefore likely on the server's side. Or you might notice that the data sent by the client is different from what you expected.

We will mainly use the two programs, Network Monitor and Ethereal, to demonstrate different network protocols. Both programs have a similar graphical user interface. A wide selection of similar programs is available in the market. The UNIX operating system offers the tcpdump command. As opposed to the programs mentioned above, tcpdump does not have a graphical user interface and is designed to be used mainly for scripts.

In addition to these tools, network monitoring hardware is also available. What are the advantages of hardware network monitors? These tools are particularly important for technical staff. Software monitors only display frames that are undamaged. It may be that a station has a damaged network interface card, which produces faulty frames. Software monitors have a difficult time recognizing these damaged stations. Moreover, Fiber Distributed Data Interface (FDDI) service frames are not displayed by software monitors.

The bigger problems with using network monitoring tools are in the area of security. The argument used against them is that they can be easily used to capture the password of network users that work with Telnet, FTP, and web browsers (in the case of the HTTP protocol).

The authors of this article, on the contrary, consider it useful to demonstrate password capturing. Even more than initial security problems, these demonstrations serve to convince companies to change their authorization method from the dangerous username/password system.