Saturday, January 05, 2008

netpack-gpack (gpackcount)

Sniffing your own network, from internet to your home / office intranet, using a Linux router...can be easily achieved with a Freesco-box, or some Linux distro, and gpackcount, a small application that shows all traffic through your networks.
gpackcount is included in the netpack-gpack, just released.
Sources are freely available, and packaged binaries are expected soon. Refer here to the release article: netpack.blogspot.com/2007/12/netpack-gpack-is-released.html



Refer here (left-side picture) for a snapshot for my own sniffing of network between a Freesco-box and another server. Some basic commands are shown to minimize traffic.

Note domains are cached within gpackcount to minimize additional traffic through domain port (UDP, 53).


Here's another snapshot of the result of brief minutes of sniffing.
You can see *.google.com, because by the time I was writting this article, gpackcount was sniffing traffic (and www.blogger.com domain belongs to all mighty Google.)

There are no fancy rules to gather traffic for a group of ports, or anything like that. The output is typically the byte comprehensive streaming, and a plain text report at the end.