Re: monitoring tool for lan

[Lukas Beeler <lukas.beeler@xxxxxxxxxxxxxxxx>]

On Wed, May 20, 2009 at 21:23, Pat Barber <mboceanside@xxxxxxxxxxxxxxxx> wrote:
> Can anybody recommend a tool that will help me
> find a pc on a lan that is opening many(thousands)
> of connections and is killing the cache of the
> firewall.

ntop
wireshark
iptraf

All of them need Linux (some may run on Windows). You'll need either a
managed Switch and mirror the Firewall, or throw a plain old hub
between the Firewall and the LAN.

> This shuts all web connections down in the
> dirt.

Replace the firewall, it's faulty or not sized appropriately. Probably both.

> The firewall folks have been of little/no help
> on what might be going on.

Replace the firewall folks.

> Apparently, an outside auditor brought a laptop
> in the office around a week ago and our accounting folks
> let him attach right into the lan with no questions.

Make sure to use 802.1x Authentication on all LAN ports accessible to
non-IT employees.

Also, replace the auditor and make sure proper disciplinary measures
are taken with the people that allowed him to connect.