External Domain Access Monitor

[adlloyd]

Hi all,

I've got 4 servers running several instances (about 12) of an application. This application receives information from and external source and uploads it to a remote SQL Server database (the databases are then viewed by our customers through a web interface).

The problem is that recently, and as we've been adding more customers i.e. more application instances, our local area network and Internet connection appear to have slowed down - I expected this to happen, but not to the level that it has done so (the data exchanged, for the most part, should be bytes).

What I want to do is monitor all LAN traffic to the SQL Server's domain to see exactly how much information (size and frequency) is being exchanged between our servers and the remote SQL server.

So, finally, is there a network-monitoring tool that will show me this kind of information, for example:

Timestamp            Source          Dest              Size     Etc.   Etc.   Etc.
01 MAR 09 00:00:00   192.168.0.1     sql.remote.com    50Kb     x      y      z
01 MAR 09 00:00:03   192.168.0.1     sql.remote.com    150Kb    x      y      z
01 MAR 09 00:00:07   192.168.0.5     sql.remote.com    25Kb     x      y      z
01 MAR 09 00:00:09   192.168.0.5     sql.remote.com    67Kb     x      y      z
01 MAR 09 00:00:12   192.168.0.5     sql.remote.com    56Kb     x      y      z
 
etc.
 

I've tried the demo of Colasoft's Capsa - Network Analyzer, but it only seems to give me this sort of information for the local machine (perhaps I have not configured it correctly).


Any help is most appreciated.

Thanks,

Andrew.

[sicarie]

Andrew, there are a few things you could do - depending on your level of expertise and the availability of spare hardware.

You could create a proxy for all the LAN traffic to go through (thus creating a single point of failure, or becoming a chokepoint).

Another option would be to install a sniffer on that device and have it run, though this would cause an increased load on your sql server.

Or, some network devices allow mirroring of traffic if you wanted to create a separate sniffer to just put on the LAN.

How are these boxes connected (router/firewall/switch and brand)?

[adlloyd]

sicarie,

Thanks for the response.

I don't really want to go down the route of setting up more hardware to monitor the problem.

As it is now, I've just set up Microsoft's network monitor on the individual PCs; interestingly it looks as if there are a few PCs on the network regularly talking to hosts that they shouldn't be (totally random and over UDP) - perhaps there's some kind of Trojan using up the network's throughput (re-install ahoy!).

Ideally, I would have liked to have been able to log all accesses to the server in one place and wondered if there was an application to do that - it would appear not :(

But thanks again for the response - I'll certainly look into them if the problem persists and renders our network/ADSL useless.

Regards,

Andrew.

[kevinzhou]

@adlloyd
Hi Andrew,

You must have not deployed Colasoft network Analyzer correctly, you can find something helpful here: http://www.colasoft.com/support/installation.php

Still if the page cannot help, feel free to contact support[at]colasoft.com

Cheers,

Kevin