Monitoring VNC traffic

Anyone know of an area where information on monitoring VNC traffic would be?
I have been asked to monitor VNC traffic and the baseline signature I have loaded
on devices seems a little lacking in scope....
Anyone else looking at this traffic on their network and can give some insight?
I didn't get alot of hits in the knowledge base when looking for VNC traffic so any
inforation can help.
Thanks...

I think mainly to see who is actually using or attempting to use VNC products...
Might be as simple as monitoring a port; this will help us track down any unauthorized
attempts at using VNC products...I just want to see what options I have.

Similar Messages

How to monitor network traffic on an IP alias?

Does anybody happen to know how I can monitor the traffic on an IP alias on say igb0:1 using iftop or something similar? iftop (pcap, I guess is the issue here) doesn't seem to cope with IP aliases.
Cheers

After fiddling around a bit with this issue I decided that it was time to embrace dladm/ipadm a bit more and exchange these old-style virtual NICs with new ones. So I dumped the old igbx:y VNICs and created new ones by issuing:
dladm create-vnic -l igb0 vnic0
followed by:
ipadm create-ip; ipadm create-addr…
Now, I can monitor these new vnics using if top just fine.

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Is there anyway to monitor network traffic on the newer Time Capsules, similar to the SNMP monitoring previously?

Can I use a real router and still have the Time Capsule for backups etc?
Yes, that is what Bridge Mode is for. Just connect the Time Capsule to a LAN <--> Ethernet port on your "main" router.

SA540 - Monitor Web Traffic (How to)?

Just as the title reads, I'm looking for a way to monitor what traffic is going through my SA540. Looking for what websites are being accessed.
Not sure how to do this. Can anyone assist?
Thanks in advance!

I looked into OPENDNS several months ago and seems like it was kinda expensive for commercial usage. It wasn't an option.
I was looking at the Status/Reports section of my 540 and it sounds like it gives the top 10 websites visited. Does this sound correct?
Of course Content Filtering must be turned on. I assume turning on Content Filtering does nothing until allowed or blocked URL data is present?
k

Monitoring interface traffic

I'm using a solution to monitor the traffic passing through the interface
SWCORE connecting with my router.
The Linux machine (sniff) has two interfaces (eth0 and eth1)
Etho (manages the machine) connected to the interface to another interface g1/18
(Sniff) connected in g1/27.
Add the following command:
monitor session 2 source interface Gi1/48
monitor session 2 destination interface Gi1/27
But I don't capture nothing.
I show monitor out following:
Session 2
Type : Local Session
Source Ports :
Both : Gi1/48
Destination Ports : Gi1/27
Encapsulation : Native
Ingress : Disabled
Learning : Disabled
Do what doing wrong? Help me??

try this "monitor session 2 source interface Gi1/48 ?"
Doesn't if show an option to span ingoing, outgoing or both traffic directions?
I think you need both
Do you see traffic on the spanport Gi1/27 if you do a "show interface Gi1/27" ?
The counters should go up
The interface Eth0 should be in promiscuous mode to capture the traffic other then for its own mac address or broad/multicast
Cheers,
Michel

Monitoring VLAN traffic

I moved from 2500 series routers to a switched network using a Catalyst 3750 and 3560 switches over the course of the last year. In my routed network I used MRTG to monitor traffic on my interfaces. In my switched network environment I have not been able to find a free or low cost tool that will monitor VLAN traffic. Any suggestions?

I have the same problem and found these links that provided answers:
http://forums.cacti.net/about29656.html&highlight=
http://www.experts-exchange.com/Hardware/Networking_Hardware/Switches/Q_23738165.html
Vlans on 3560s, 3750s and 3550s do not show stats. The packets are forwarded with the ASIC chips and do not cross the CPU for actual processing. To actually see the traffic you will need to turn off CEF, which decrases the performance significantly (not recommended, see links above).

Monitor the traffic/bandwidth of local computers ?

Hi everyone,
What is the software/script to monitor the traffic/bandwidth of the local users ?
I'm currently has Xserve as like a DHCP/gateway, and there are about 20 computers connects through Xserve. I'd like to monitor the local computers to see their bandwidth but not sure what script/software need to be installed on Xserve. All my local computers have ip 10.10.x.x.
I installed darkstat but it doesn't show me the specific ip address that taking how much bandwidth (like download/upload speed..).
Thanks

Take a look at Intermapper <http://dartware.com/>, Lithium <http://lithiumcorp.com/> and Zenoss <http://www.zenoss.com/>. They should be able to do what you want. Hope that helps.
- Barrett

Generate and Monitor Interconnect traffic

Guys
Does anyone has scripts to generate and monitor interconnect traffic? I am trying to test my interconnect on 4 node RAC (10gR2)
Any help?
Thanks in advance
PG

See if this helps....we use the below script to monitor the interconnect traffic.
select b1.inst_id,
b2.value "GCS CR BLOCKS RECEIVED",
b1.value "GCS CR BLOCK RECEIVE TIME",
((b1.value / b2.value) * 10) "AVG CR BLOCK RECEIVE TIME (ms)"
from gv$sysstat b1,
gv$sysstat b2
where b1.name = 'global cache cr block receive time' and
b2.name = 'global cache cr blocks received' and
b1.inst_id = b2.inst_id

Monitor visitor traffic

Hi- Is the hit counter button the only way to monitor visitor traffic? Is there a way to see who is visiting my site? Thanks for your time.

I use stat counter, it IS safe and there ISN'T anything on a Mac so there is the need of 3rd party software. Another is Google Anayltics, but that's more complicated. You can use iTweak to easily apply your statcounter code, too

L4 traffic monitor - blocking traffic ?

Hello
How does L4 traffic monitor is blocking traffic if T1/T2 ports are "tap/sniffed ports" ?
For SPAN we might have "ingress vlan feature" which would allow us to send TCP RST (like IPS does),
but for hardware TAP we do not have such a feature.
So - maybe L4 traffic monitor can not block any traffic, just make a decision what to block and execution is on WebProxy and P1/2 ports ?
Thanks

Michael,
Yes, the reset is sent via P1
Ken
Sent from Cisco Technical Support iPad App

Control and monitoring of traffic lights

i am a student and new to graphical programming.i am using labview 6.1 to monitor and control a system of traffic lights from a central location.my problem is geting the lights to go on and off.

You asked the same question here and the answer is still the same. Provide some details on what exactly you're attempting to do and what specifically is the problem. That means details on what kind of hardware you're using to interface to the lights, any error codes being generated, etc. Posting your program would help as well.

I cannot monitor trunk traffic

I have two trunk port over Metroethernet contains several VLAN. And Cisco 3550 is meeting point for 2 trunk. I wanna monitor those trunk (far sites) traffic.
I try several SPAN on cisco 3550 switch but i didn’t get a source-destination traffic .
Here is my configs and output. And you can see my topology in attachement:
Config I:
monitor session 1 source vlan 1 - 4094 rx
monitor session 1 destination interface Fa0/8
Output 1 (tcpdump -i eth1)
10:28:49.398386 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:69:48:6a.800a, length 43
10:28:49.403695 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.423092 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:b2:73:c0.800c, length 43
10:28:49.435660 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.467041 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.503562 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.511120 IP 172.16.1.46 > ospf-all.mcast.net: OSPFv2, Hello, length 60
10:28:49.512063 IP 172.16.2.46 > ospf-all.mcast.net: OSPFv2, Hello, length 60
Config II:
monitor session 1 source vlan 1 - 4094 rx
monitor session 1 destination interface Fa0/8 encapsulation dot1q
Output II (tcpdump -i eth1)
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
Config III:monitor session 1 source interface Fa0/20
monitor session 1 destination interface Fa0/8
Output III (tcpdump -i eth1)
10:43:59.148118 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.160031 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:07:5d:ff.8008, length 43
10:43:59.181057 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:07:5e:3b.8009, length 43
10:43:59.183669 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.188202 IP 172.16.1.114 > ospf-all.mcast.net: OSPFv2, Hello, length 56
10:43:59.219978 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.251886 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 1444
10:43:59.255620 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.258862 IP 172.16.1.181 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 64
10:43:59.264209 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:f3:63:75.800e, length 43
10:43:59.267031 IP 172.16.1.185 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 84
10:43:59.285143 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:3a:65:4a.800e, length 43
10:43:59.290841 IP 172.16.2.182 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 84
Config IV:
monitor session 1 source interface Fa0/20
monitor session 1 destination interface Fa0/8 encapsulation dot1q
Output IV (tcpdump -i eth1)
10:45:54.508798 STP 802.1d, Topology Change
10:45:56.508461 STP 802.1d, Topology Change
10:45:58.508160 STP 802.1d, Topology Change
10:45:58.748225 DTPv1, length 38
10:46:00.508760 STP 802.1d, Topology Change
10:46:02.508853 STP 802.1d, Topology Change
10:46:04.508826 STP 802.1d, Topology Change
Config V:
monitor session 1 source interface Fa0/20 - 21 rx
monitor session 1 destination interface Fa0/8
Output V (tcpdump -i eth1)
10:50:14.464530 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:e3:48:b6.800c, length 43
10:50:14.473268 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.481147 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:cd:64:22.8008, length 43
10:50:14.484894 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:e3:48:da.800b, length 43
10:50:14.491750 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:cd:63:e5.8009, length 43
10:50:14.500191 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:32:8c:52.800e, length 43
10:50:14.505504 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.541735 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.549495 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 1444
10:50:14.577783 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.600906 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:32:8c:4a.800d, length 43
10:50:14.613448 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.649487 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.684209 IP 172.16.1.198 > ospf-all.mcast.net: OSPFv2, Hello, length 60
10:50:14.685534 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.704529 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:04:62:cd.800e, length 43
10:50:14.706505 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:04:62:d9.800f, length 43
I can't see hsot interactions. Why?
And How do you solve this problem?

You will not be able to tell if Firefox was used in private browsing mode. When in that mode Firefox does not store any details about web browsing.
One option you can use is to install a free parental control program such as K9 Web Protection - http://www1.k9webprotection.com/ - That program can be used to block access to sites based on categories that you choose. It will work with all browsers and does not matter if they are in private browsing mode or not.

Weird - Activity Monitor Network Traffic vs iStat Traffic

With no applications running on my MacBook Pro, the Network tab of the Activity monitor is showing 'Data received/sec" toggling every second or so between 1.38 KB/s and 2.75 KB/s. It's showing the same numbers for 'Data sent/sec' as well. I can't figure out what is causing this network traffic. But if it's real, it's adding up to about 5 GB a month of bandwidth usage. My cap is only 60 GB so it's significant.
But when I use iStat or the Net Monitor app to monitor throughput, they show 0.0 traffic when the system is idle. Also, since last night Activity Monitor shows 322 MB data received and 99 MB data sent. While iStat shows 239 MB received and 16 MB sent.
So which is correct? Does Activity Monitor also include traffic that is internal to my network? Or do I have a phantom bandwidth hog somewhere?
Thanks for any insight to the weirdness.
Jim

The switches at home and at work generally corroborate the activity shown by tcpdump / atMonitor / MenuMeters, not the continuous data flow shown by Activity Monitor. The MacBook Air I'm sitting at right now shows similar discrepancies, with traffic totals in Activity Monitor about 40x higher than those shown with the other tools and a steady and inexplicable (and by other means invisible) 29-34 KB/sec of both sent & received traffic. tcpdump shows periods of network silence between 2-15 seconds in length (in between DNS lookups; netbios syncs; ntp queries; ipp messages; http, pop, and imap messages; etc. happening in bursts as one would expect).
Changing Activity Monitor to refresh every half second shows the mystery traffic as a burst of 112 KB sent & received every two seconds--and no, that's not the same throughput as the 29-34 KB seen at 2-second refresh intervals. When I set refresh to every 5 seconds, the mystery throughput drops to 22 KB / sec. As the throughput varies depending on refresh interval, I wonder if I'm seeing internal loopback queries (or something of that sort) contributing to the totals. Is it possible that the mystery traffic is of AM's own creation, and only exists within the machine and is not actually sent on the network?
Lest we digress further into general network troubleshooting techniques, let me restate the question, perhaps a bit more clearly: has anyone else seen this traffic-volume discrepancy between the Activity Monitor's Network tab and other network monitoring tools, and does anyone have an explanation for it?

How to monitor Bluetooth traffic/signal

I'm curious if there is an application that allows me to monitor the strength of the Bluetooth signal my computer is receiving and the amount of traffic and what devices are connected.
Thanks!

this thread should help you...
http://discussions.apple.com/thread.jspa?threadID=432708&tstart=25

Can I monitor JMS traffic (not the contents) for MDBs?

WL 9.2.2 on AIX 5.3.
I have an EAR deployed to our domains that a third-party vendor developed. It has MDBs that are configured to be persistent. Messages appearing on the queue are read quickly and sent elsewhere. I thought that I should be able to go to the Monitoring page of the JMS queue and see some information about traffic, even though I can't see the actual messages. When I go to the Monitoring tab for the queue, the list is always empty, even though I'm pretty sure messages are being processed through the queue.
An engineer from the vendor said that "So all the messages that were sent and acknowledged are never persisted in the filestore and hence you cannot view those messages from the weblogic console". I certainly believe him that I wouldn't be able to view the contents of messages after they are removed from the store, but I would assume that the traffic history is still kept.
Am I misunderstanding what I should be able to see here?

You can see certain attributes something like "Messages High" and "Consumers Current", "Consumers High", but no copies of messages would be kept. If consumers are active and always reading off messages as they come in, then "Messages High" will likely not even increment. If you want to see the messages you could pause consumption of the queue, which should not block production of messages. Then you should be able to see messages start "queueing up" until you unpause comsumption.

Monitoring VNC traffic

Similar Messages

Maybe you are looking for